@kolisachint/hoocode-agent 0.5.29 → 0.5.31

package/dist/core/light.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"light.d.ts","sourceRoot":"","sources":["../../src/core/light.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAEjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGtD,8CAA8C;AAC9C,eAAO,MAAM,gBAAgB,4CAA6C,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,2MAEP,CAAC;AAE1B;;;;;GAKG;AACH,eAAO,MAAM,cAAc,kBAAkB,CAAC;AAE9C,+DAA+D;AAC/D,wBAAgB,cAAc,IAAI,OAAO,CAExC;AA4BD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAgDvE;AAED,6DAA6D;AAC7D,MAAM,WAAW,aAAa;IAC7B,uDAAuD;IACvD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,gBAAgB,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/C;AAOD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,IAAI,MAAM,EAAE,CAAC;IAC/B,WAAW,IAAI,QAAQ,EAAE,CAAC;CAC1B,GAAG,aAAa,CAmBhB","sourcesContent":["/**\n * Light mode — a minimal, low-token preset for small/local models.\n *\n * The preset restricts the session to the four core tools (read, write, edit,\n * bash) with shortened descriptions and undocumented parameter schemas,\n * replaces the default system prompt with a terse one, and disables\n * subagents, TodoWrite, skills, context files, and the mode-prompt appendix.\n * The goal is the smallest possible fixed per-turn surface (system prompt +\n * serialized tool schemas) so weak tool-callers waste no context on harness\n * boilerplate. bash subsumes grep/find/ls: search happens via the shell.\n */\n\nimport type { AgentTool } from \"@kolisachint/hoocode-agent-core\";\nimport { Type } from \"typebox\";\nimport type { ToolInfo } from \"./extensions/types.js\";\nimport { createBashTool, createEditTool, createReadTool, createWriteTool } from \"./tools/index.js\";\n\n/** The only tools a light session exposes. */\nexport const LIGHT_TOOL_NAMES = [\"read\", \"write\", \"edit\", \"bash\"] as const;\n\n/**\n * Terse replacement for the default system prompt. buildSystemPrompt appends\n * the current date and working directory; nothing else rides along because\n * light mode also disables skills, context files, and the mode appendix.\n */\nexport const LIGHT_SYSTEM_PROMPT = `You are a coding agent. Use the tools to read, edit, and write files and run shell commands.\nSearch with bash (grep/find/ls). Prefer edit for changes; write for new files.\nBe concise. No preamble.`;\n\n/**\n * Environment flag signaling light mode to code that cannot see CLI flags or\n * settings — notably the hoo-core modes extension, which reads it to skip the\n * `<!-- hoo-core: mode= -->` system-prompt appendix. Same pattern as\n * WARM_SUBAGENTS_ENV / SUBAGENT_MAX_DEPTH_ENV.\n */\nexport const LIGHT_MODE_ENV = \"HOOCODE_LIGHT\";\n\n/** Whether light mode was signaled through the environment. */\nexport function isLightModeEnv(): boolean {\n\treturn process.env[LIGHT_MODE_ENV] === \"1\";\n}\n\n// Light parameter schemas: same shapes the real tools accept, minus the\n// per-property descriptions (that is where most schema tokens live).\nconst lightReadSchema = Type.Object({\n\tpath: Type.String(),\n\toffset: Type.Optional(Type.Number()),\n\tlimit: Type.Optional(Type.Number()),\n});\n\nconst lightWriteSchema = Type.Object({\n\tpath: Type.String(),\n\tcontent: Type.String(),\n});\n\n// Flat single-replacement shape instead of the full edits[] batch schema. The\n// execute shim below converts it to the batch form the real edit tool expects.\nconst lightEditSchema = Type.Object({\n\tpath: Type.String(),\n\toldText: Type.String(),\n\tnewText: Type.String(),\n});\n\nconst lightBashSchema = Type.Object({\n\tcommand: Type.String(),\n\ttimeout: Type.Optional(Type.Number()),\n});\n\n/**\n * Build the four light tools for `baseToolsOverride`: the real tool\n * implementations wearing short descriptions and stripped parameter schemas.\n */\nexport function createLightTools(cwd: string): Record<string, AgentTool> {\n\tconst read = createReadTool(cwd);\n\tconst write = createWriteTool(cwd);\n\tconst edit = createEditTool(cwd);\n\tconst bash = createBashTool(cwd);\n\n\tconst lightRead: AgentTool<typeof lightReadSchema> = {\n\t\t...read,\n\t\tdescription: \"Read a file. args: path, offset?, limit?\",\n\t\tparameters: lightReadSchema,\n\t};\n\n\tconst lightWrite: AgentTool<typeof lightWriteSchema> = {\n\t\t...write,\n\t\tdescription: \"Write file (overwrites). args: path, content\",\n\t\tparameters: lightWriteSchema,\n\t};\n\n\t// The real edit tool validates against its edits[] schema after\n\t// prepareArguments runs, so the flat light shape must skip the original\n\t// prepareArguments (validation sees the raw flat args against the flat\n\t// schema) and convert to the batch form at execute time instead.\n\tconst lightEdit: AgentTool<typeof lightEditSchema> = {\n\t\t...edit,\n\t\tdescription: \"Replace exact text. args: path, oldText, newText\",\n\t\tparameters: lightEditSchema,\n\t\tprepareArguments: undefined,\n\t\texecute: (toolCallId, params, signal, onUpdate) =>\n\t\t\tedit.execute(\n\t\t\t\ttoolCallId,\n\t\t\t\t{ path: params.path, edits: [{ oldText: params.oldText, newText: params.newText }] },\n\t\t\t\tsignal,\n\t\t\t\tonUpdate,\n\t\t\t),\n\t};\n\n\tconst lightBash: AgentTool<typeof lightBashSchema> = {\n\t\t...bash,\n\t\tdescription: \"Run a shell command. args: command, timeout?\",\n\t\tparameters: lightBashSchema,\n\t};\n\n\treturn {\n\t\tread: lightRead as AgentTool,\n\t\twrite: lightWrite as AgentTool,\n\t\tedit: lightEdit as AgentTool,\n\t\tbash: lightBash as AgentTool,\n\t};\n}\n\n/** Token breakdown of a session's fixed per-turn surface. */\nexport interface PromptSurface {\n\t/** Estimated tokens in the assembled system prompt. */\n\tsystemPromptTokens: number;\n\t/** Estimated tokens across the serialized active tool schemas. */\n\ttoolSchemaTokens: number;\n\t/** systemPromptTokens + toolSchemaTokens. */\n\ttotalTokens: number;\n\t/** Per-tool breakdown of the serialized schema estimate. */\n\ttools: Array<{ name: string; tokens: number }>;\n}\n\n/** Same conservative chars/4 heuristic the agent harness uses for context estimates. */\nfunction estimateStringTokens(text: string): number {\n\treturn Math.ceil(text.length / 4);\n}\n\n/**\n * Measure the fixed per-turn surface a session sends on every request: the\n * assembled system prompt plus the serialized schemas (name, description,\n * parameters) of the active tools. Providers add their own envelope on top,\n * so treat the result as a floor estimate.\n */\nexport function measurePromptSurface(session: {\n\tsystemPrompt: string;\n\tgetActiveToolNames(): string[];\n\tgetAllTools(): ToolInfo[];\n}): PromptSurface {\n\tconst activeNames = new Set(session.getActiveToolNames());\n\tconst tools = session\n\t\t.getAllTools()\n\t\t.filter((tool) => activeNames.has(tool.name))\n\t\t.map((tool) => ({\n\t\t\tname: tool.name,\n\t\t\ttokens: estimateStringTokens(\n\t\t\t\tJSON.stringify({ name: tool.name, description: tool.description, parameters: tool.parameters }),\n\t\t\t),\n\t\t}));\n\tconst systemPromptTokens = estimateStringTokens(session.systemPrompt);\n\tconst toolSchemaTokens = tools.reduce((sum, tool) => sum + tool.tokens, 0);\n\treturn {\n\t\tsystemPromptTokens,\n\t\ttoolSchemaTokens,\n\t\ttotalTokens: systemPromptTokens + toolSchemaTokens,\n\t\ttools,\n\t};\n}\n"]}
+{"version":3,"file":"light.d.ts","sourceRoot":"","sources":["../../src/core/light.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAEjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGtD,8CAA8C;AAC9C,eAAO,MAAM,gBAAgB,4CAA6C,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,2MAEP,CAAC;AAE1B;;;;;GAKG;AACH,eAAO,MAAM,cAAc,kBAAkB,CAAC;AAE9C,+DAA+D;AAC/D,wBAAgB,cAAc,IAAI,OAAO,CAExC;AA4BD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAgDvE;AAED,6DAA6D;AAC7D,MAAM,WAAW,aAAa;IAC7B,uDAAuD;IACvD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,gBAAgB,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/C;AAOD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAI9D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,IAAI,MAAM,EAAE,CAAC;IAC/B,WAAW,IAAI,QAAQ,EAAE,CAAC;CAC1B,GAAG,aAAa,CAchB","sourcesContent":["/**\n * Light mode — a minimal, low-token preset for small/local models.\n *\n * The preset restricts the session to the four core tools (read, write, edit,\n * bash) with shortened descriptions and undocumented parameter schemas,\n * replaces the default system prompt with a terse one, and disables\n * subagents, TodoWrite, skills, context files, and the mode-prompt appendix.\n * The goal is the smallest possible fixed per-turn surface (system prompt +\n * serialized tool schemas) so weak tool-callers waste no context on harness\n * boilerplate. bash subsumes grep/find/ls: search happens via the shell.\n */\n\nimport type { AgentTool } from \"@kolisachint/hoocode-agent-core\";\nimport { Type } from \"typebox\";\nimport type { ToolInfo } from \"./extensions/types.js\";\nimport { createBashTool, createEditTool, createReadTool, createWriteTool } from \"./tools/index.js\";\n\n/** The only tools a light session exposes. */\nexport const LIGHT_TOOL_NAMES = [\"read\", \"write\", \"edit\", \"bash\"] as const;\n\n/**\n * Terse replacement for the default system prompt. buildSystemPrompt appends\n * the current date and working directory; nothing else rides along because\n * light mode also disables skills, context files, and the mode appendix.\n */\nexport const LIGHT_SYSTEM_PROMPT = `You are a coding agent. Use the tools to read, edit, and write files and run shell commands.\nSearch with bash (grep/find/ls). Prefer edit for changes; write for new files.\nBe concise. No preamble.`;\n\n/**\n * Environment flag signaling light mode to code that cannot see CLI flags or\n * settings — notably the hoo-core modes extension, which reads it to skip the\n * `<!-- hoo-core: mode= -->` system-prompt appendix. Same pattern as\n * WARM_SUBAGENTS_ENV / SUBAGENT_MAX_DEPTH_ENV.\n */\nexport const LIGHT_MODE_ENV = \"HOOCODE_LIGHT\";\n\n/** Whether light mode was signaled through the environment. */\nexport function isLightModeEnv(): boolean {\n\treturn process.env[LIGHT_MODE_ENV] === \"1\";\n}\n\n// Light parameter schemas: same shapes the real tools accept, minus the\n// per-property descriptions (that is where most schema tokens live).\nconst lightReadSchema = Type.Object({\n\tpath: Type.String(),\n\toffset: Type.Optional(Type.Number()),\n\tlimit: Type.Optional(Type.Number()),\n});\n\nconst lightWriteSchema = Type.Object({\n\tpath: Type.String(),\n\tcontent: Type.String(),\n});\n\n// Flat single-replacement shape instead of the full edits[] batch schema. The\n// execute shim below converts it to the batch form the real edit tool expects.\nconst lightEditSchema = Type.Object({\n\tpath: Type.String(),\n\toldText: Type.String(),\n\tnewText: Type.String(),\n});\n\nconst lightBashSchema = Type.Object({\n\tcommand: Type.String(),\n\ttimeout: Type.Optional(Type.Number()),\n});\n\n/**\n * Build the four light tools for `baseToolsOverride`: the real tool\n * implementations wearing short descriptions and stripped parameter schemas.\n */\nexport function createLightTools(cwd: string): Record<string, AgentTool> {\n\tconst read = createReadTool(cwd);\n\tconst write = createWriteTool(cwd);\n\tconst edit = createEditTool(cwd);\n\tconst bash = createBashTool(cwd);\n\n\tconst lightRead: AgentTool<typeof lightReadSchema> = {\n\t\t...read,\n\t\tdescription: \"Read a file. args: path, offset?, limit?\",\n\t\tparameters: lightReadSchema,\n\t};\n\n\tconst lightWrite: AgentTool<typeof lightWriteSchema> = {\n\t\t...write,\n\t\tdescription: \"Write file (overwrites). args: path, content\",\n\t\tparameters: lightWriteSchema,\n\t};\n\n\t// The real edit tool validates against its edits[] schema after\n\t// prepareArguments runs, so the flat light shape must skip the original\n\t// prepareArguments (validation sees the raw flat args against the flat\n\t// schema) and convert to the batch form at execute time instead.\n\tconst lightEdit: AgentTool<typeof lightEditSchema> = {\n\t\t...edit,\n\t\tdescription: \"Replace exact text. args: path, oldText, newText\",\n\t\tparameters: lightEditSchema,\n\t\tprepareArguments: undefined,\n\t\texecute: (toolCallId, params, signal, onUpdate) =>\n\t\t\tedit.execute(\n\t\t\t\ttoolCallId,\n\t\t\t\t{ path: params.path, edits: [{ oldText: params.oldText, newText: params.newText }] },\n\t\t\t\tsignal,\n\t\t\t\tonUpdate,\n\t\t\t),\n\t};\n\n\tconst lightBash: AgentTool<typeof lightBashSchema> = {\n\t\t...bash,\n\t\tdescription: \"Run a shell command. args: command, timeout?\",\n\t\tparameters: lightBashSchema,\n\t};\n\n\treturn {\n\t\tread: lightRead as AgentTool,\n\t\twrite: lightWrite as AgentTool,\n\t\tedit: lightEdit as AgentTool,\n\t\tbash: lightBash as AgentTool,\n\t};\n}\n\n/** Token breakdown of a session's fixed per-turn surface. */\nexport interface PromptSurface {\n\t/** Estimated tokens in the assembled system prompt. */\n\tsystemPromptTokens: number;\n\t/** Estimated tokens across the serialized active tool schemas. */\n\ttoolSchemaTokens: number;\n\t/** systemPromptTokens + toolSchemaTokens. */\n\ttotalTokens: number;\n\t/** Per-tool breakdown of the serialized schema estimate. */\n\ttools: Array<{ name: string; tokens: number }>;\n}\n\n/** Same conservative chars/4 heuristic the agent harness uses for context estimates. */\nfunction estimateStringTokens(text: string): number {\n\treturn Math.ceil(text.length / 4);\n}\n\n/**\n * What one tool costs on every request: its serialized `{name, description,\n * parameters}`, the three fields a provider re-sends each turn.\n *\n * Exported because the surface is worth showing for a tool that is *off* too —\n * `/settings` prices each toggle with it, and a disabled tool has no entry in a\n * measured surface precisely because it currently costs nothing.\n */\nexport function measureToolSchemaTokens(tool: ToolInfo): number {\n\treturn estimateStringTokens(\n\t\tJSON.stringify({ name: tool.name, description: tool.description, parameters: tool.parameters }),\n\t);\n}\n\n/**\n * Measure the fixed per-turn surface a session sends on every request: the\n * assembled system prompt plus the serialized schemas (name, description,\n * parameters) of the active tools. Providers add their own envelope on top,\n * so treat the result as a floor estimate.\n */\nexport function measurePromptSurface(session: {\n\tsystemPrompt: string;\n\tgetActiveToolNames(): string[];\n\tgetAllTools(): ToolInfo[];\n}): PromptSurface {\n\tconst activeNames = new Set(session.getActiveToolNames());\n\tconst tools = session\n\t\t.getAllTools()\n\t\t.filter((tool) => activeNames.has(tool.name))\n\t\t.map((tool) => ({ name: tool.name, tokens: measureToolSchemaTokens(tool) }));\n\tconst systemPromptTokens = estimateStringTokens(session.systemPrompt);\n\tconst toolSchemaTokens = tools.reduce((sum, tool) => sum + tool.tokens, 0);\n\treturn {\n\t\tsystemPromptTokens,\n\t\ttoolSchemaTokens,\n\t\ttotalTokens: systemPromptTokens + toolSchemaTokens,\n\t\ttools,\n\t};\n}\n"]}

package/dist/core/light.js

@@ -100,6 +100,17 @@ export function createLightTools(cwd) {
 function estimateStringTokens(text) {
     return Math.ceil(text.length / 4);
 }
+/**
+ * What one tool costs on every request: its serialized `{name, description,
+ * parameters}`, the three fields a provider re-sends each turn.
+ *
+ * Exported because the surface is worth showing for a tool that is *off* too —
+ * `/settings` prices each toggle with it, and a disabled tool has no entry in a
+ * measured surface precisely because it currently costs nothing.
+ */
+export function measureToolSchemaTokens(tool) {
+    return estimateStringTokens(JSON.stringify({ name: tool.name, description: tool.description, parameters: tool.parameters }));
+}
 /**
  * Measure the fixed per-turn surface a session sends on every request: the
  * assembled system prompt plus the serialized schemas (name, description,
@@ -111,10 +122,7 @@ export function measurePromptSurface(session) {
     const tools = session
         .getAllTools()
         .filter((tool) => activeNames.has(tool.name))
-        .map((tool) => ({
-        name: tool.name,
-        tokens: estimateStringTokens(JSON.stringify({ name: tool.name, description: tool.description, parameters: tool.parameters })),
-    }));
+        .map((tool) => ({ name: tool.name, tokens: measureToolSchemaTokens(tool) }));
     const systemPromptTokens = estimateStringTokens(session.systemPrompt);
     const toolSchemaTokens = tools.reduce((sum, tool) => sum + tool.tokens, 0);
     return {

package/dist/core/light.js.map

@@ -1 +1 @@
-{"version":3,"file":"light.js","sourceRoot":"","sources":["../../src/core/light.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE/B,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnG,8CAA8C;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;;yBAEV,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC;AAE9C,+DAA+D;AAC/D,MAAM,UAAU,cAAc,GAAY;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,GAAG,CAAC;AAAA,CAC3C;AAED,wEAAwE;AACxE,qEAAqE;AACrE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACpC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,+EAA+E;AAC/E,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;IACnC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;CACrC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAA6B;IACxE,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAEjC,MAAM,SAAS,GAAsC;QACpD,GAAG,IAAI;QACP,WAAW,EAAE,0CAA0C;QACvD,UAAU,EAAE,eAAe;KAC3B,CAAC;IAEF,MAAM,UAAU,GAAuC;QACtD,GAAG,KAAK;QACR,WAAW,EAAE,8CAA8C;QAC3D,UAAU,EAAE,gBAAgB;KAC5B,CAAC;IAEF,gEAAgE;IAChE,wEAAwE;IACxE,uEAAuE;IACvE,iEAAiE;IACjE,MAAM,SAAS,GAAsC;QACpD,GAAG,IAAI;QACP,WAAW,EAAE,kDAAkD;QAC/D,UAAU,EAAE,eAAe;QAC3B,gBAAgB,EAAE,SAAS;QAC3B,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CACjD,IAAI,CAAC,OAAO,CACX,UAAU,EACV,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,EACpF,MAAM,EACN,QAAQ,CACR;KACF,CAAC;IAEF,MAAM,SAAS,GAAsC;QACpD,GAAG,IAAI;QACP,WAAW,EAAE,8CAA8C;QAC3D,UAAU,EAAE,eAAe;KAC3B,CAAC;IAEF,OAAO;QACN,IAAI,EAAE,SAAsB;QAC5B,KAAK,EAAE,UAAuB;QAC9B,IAAI,EAAE,SAAsB;QAC5B,IAAI,EAAE,SAAsB;KAC5B,CAAC;AAAA,CACF;AAcD,wFAAwF;AACxF,SAAS,oBAAoB,CAAC,IAAY,EAAU;IACnD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAAA,CAClC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAIpC,EAAiB;IACjB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,OAAO;SACnB,WAAW,EAAE;SACb,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC5C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,oBAAoB,CAC3B,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAC/F;KACD,CAAC,CAAC,CAAC;IACL,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACtE,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3E,OAAO;QACN,kBAAkB;QAClB,gBAAgB;QAChB,WAAW,EAAE,kBAAkB,GAAG,gBAAgB;QAClD,KAAK;KACL,CAAC;AAAA,CACF","sourcesContent":["/**\n * Light mode — a minimal, low-token preset for small/local models.\n *\n * The preset restricts the session to the four core tools (read, write, edit,\n * bash) with shortened descriptions and undocumented parameter schemas,\n * replaces the default system prompt with a terse one, and disables\n * subagents, TodoWrite, skills, context files, and the mode-prompt appendix.\n * The goal is the smallest possible fixed per-turn surface (system prompt +\n * serialized tool schemas) so weak tool-callers waste no context on harness\n * boilerplate. bash subsumes grep/find/ls: search happens via the shell.\n */\n\nimport type { AgentTool } from \"@kolisachint/hoocode-agent-core\";\nimport { Type } from \"typebox\";\nimport type { ToolInfo } from \"./extensions/types.js\";\nimport { createBashTool, createEditTool, createReadTool, createWriteTool } from \"./tools/index.js\";\n\n/** The only tools a light session exposes. */\nexport const LIGHT_TOOL_NAMES = [\"read\", \"write\", \"edit\", \"bash\"] as const;\n\n/**\n * Terse replacement for the default system prompt. buildSystemPrompt appends\n * the current date and working directory; nothing else rides along because\n * light mode also disables skills, context files, and the mode appendix.\n */\nexport const LIGHT_SYSTEM_PROMPT = `You are a coding agent. Use the tools to read, edit, and write files and run shell commands.\nSearch with bash (grep/find/ls). Prefer edit for changes; write for new files.\nBe concise. No preamble.`;\n\n/**\n * Environment flag signaling light mode to code that cannot see CLI flags or\n * settings — notably the hoo-core modes extension, which reads it to skip the\n * `<!-- hoo-core: mode= -->` system-prompt appendix. Same pattern as\n * WARM_SUBAGENTS_ENV / SUBAGENT_MAX_DEPTH_ENV.\n */\nexport const LIGHT_MODE_ENV = \"HOOCODE_LIGHT\";\n\n/** Whether light mode was signaled through the environment. */\nexport function isLightModeEnv(): boolean {\n\treturn process.env[LIGHT_MODE_ENV] === \"1\";\n}\n\n// Light parameter schemas: same shapes the real tools accept, minus the\n// per-property descriptions (that is where most schema tokens live).\nconst lightReadSchema = Type.Object({\n\tpath: Type.String(),\n\toffset: Type.Optional(Type.Number()),\n\tlimit: Type.Optional(Type.Number()),\n});\n\nconst lightWriteSchema = Type.Object({\n\tpath: Type.String(),\n\tcontent: Type.String(),\n});\n\n// Flat single-replacement shape instead of the full edits[] batch schema. The\n// execute shim below converts it to the batch form the real edit tool expects.\nconst lightEditSchema = Type.Object({\n\tpath: Type.String(),\n\toldText: Type.String(),\n\tnewText: Type.String(),\n});\n\nconst lightBashSchema = Type.Object({\n\tcommand: Type.String(),\n\ttimeout: Type.Optional(Type.Number()),\n});\n\n/**\n * Build the four light tools for `baseToolsOverride`: the real tool\n * implementations wearing short descriptions and stripped parameter schemas.\n */\nexport function createLightTools(cwd: string): Record<string, AgentTool> {\n\tconst read = createReadTool(cwd);\n\tconst write = createWriteTool(cwd);\n\tconst edit = createEditTool(cwd);\n\tconst bash = createBashTool(cwd);\n\n\tconst lightRead: AgentTool<typeof lightReadSchema> = {\n\t\t...read,\n\t\tdescription: \"Read a file. args: path, offset?, limit?\",\n\t\tparameters: lightReadSchema,\n\t};\n\n\tconst lightWrite: AgentTool<typeof lightWriteSchema> = {\n\t\t...write,\n\t\tdescription: \"Write file (overwrites). args: path, content\",\n\t\tparameters: lightWriteSchema,\n\t};\n\n\t// The real edit tool validates against its edits[] schema after\n\t// prepareArguments runs, so the flat light shape must skip the original\n\t// prepareArguments (validation sees the raw flat args against the flat\n\t// schema) and convert to the batch form at execute time instead.\n\tconst lightEdit: AgentTool<typeof lightEditSchema> = {\n\t\t...edit,\n\t\tdescription: \"Replace exact text. args: path, oldText, newText\",\n\t\tparameters: lightEditSchema,\n\t\tprepareArguments: undefined,\n\t\texecute: (toolCallId, params, signal, onUpdate) =>\n\t\t\tedit.execute(\n\t\t\t\ttoolCallId,\n\t\t\t\t{ path: params.path, edits: [{ oldText: params.oldText, newText: params.newText }] },\n\t\t\t\tsignal,\n\t\t\t\tonUpdate,\n\t\t\t),\n\t};\n\n\tconst lightBash: AgentTool<typeof lightBashSchema> = {\n\t\t...bash,\n\t\tdescription: \"Run a shell command. args: command, timeout?\",\n\t\tparameters: lightBashSchema,\n\t};\n\n\treturn {\n\t\tread: lightRead as AgentTool,\n\t\twrite: lightWrite as AgentTool,\n\t\tedit: lightEdit as AgentTool,\n\t\tbash: lightBash as AgentTool,\n\t};\n}\n\n/** Token breakdown of a session's fixed per-turn surface. */\nexport interface PromptSurface {\n\t/** Estimated tokens in the assembled system prompt. */\n\tsystemPromptTokens: number;\n\t/** Estimated tokens across the serialized active tool schemas. */\n\ttoolSchemaTokens: number;\n\t/** systemPromptTokens + toolSchemaTokens. */\n\ttotalTokens: number;\n\t/** Per-tool breakdown of the serialized schema estimate. */\n\ttools: Array<{ name: string; tokens: number }>;\n}\n\n/** Same conservative chars/4 heuristic the agent harness uses for context estimates. */\nfunction estimateStringTokens(text: string): number {\n\treturn Math.ceil(text.length / 4);\n}\n\n/**\n * Measure the fixed per-turn surface a session sends on every request: the\n * assembled system prompt plus the serialized schemas (name, description,\n * parameters) of the active tools. Providers add their own envelope on top,\n * so treat the result as a floor estimate.\n */\nexport function measurePromptSurface(session: {\n\tsystemPrompt: string;\n\tgetActiveToolNames(): string[];\n\tgetAllTools(): ToolInfo[];\n}): PromptSurface {\n\tconst activeNames = new Set(session.getActiveToolNames());\n\tconst tools = session\n\t\t.getAllTools()\n\t\t.filter((tool) => activeNames.has(tool.name))\n\t\t.map((tool) => ({\n\t\t\tname: tool.name,\n\t\t\ttokens: estimateStringTokens(\n\t\t\t\tJSON.stringify({ name: tool.name, description: tool.description, parameters: tool.parameters }),\n\t\t\t),\n\t\t}));\n\tconst systemPromptTokens = estimateStringTokens(session.systemPrompt);\n\tconst toolSchemaTokens = tools.reduce((sum, tool) => sum + tool.tokens, 0);\n\treturn {\n\t\tsystemPromptTokens,\n\t\ttoolSchemaTokens,\n\t\ttotalTokens: systemPromptTokens + toolSchemaTokens,\n\t\ttools,\n\t};\n}\n"]}
+{"version":3,"file":"light.js","sourceRoot":"","sources":["../../src/core/light.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE/B,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnG,8CAA8C;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;;yBAEV,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC;AAE9C,+DAA+D;AAC/D,MAAM,UAAU,cAAc,GAAY;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,GAAG,CAAC;AAAA,CAC3C;AAED,wEAAwE;AACxE,qEAAqE;AACrE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACpC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,+EAA+E;AAC/E,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;IACnC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;CACrC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAA6B;IACxE,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAEjC,MAAM,SAAS,GAAsC;QACpD,GAAG,IAAI;QACP,WAAW,EAAE,0CAA0C;QACvD,UAAU,EAAE,eAAe;KAC3B,CAAC;IAEF,MAAM,UAAU,GAAuC;QACtD,GAAG,KAAK;QACR,WAAW,EAAE,8CAA8C;QAC3D,UAAU,EAAE,gBAAgB;KAC5B,CAAC;IAEF,gEAAgE;IAChE,wEAAwE;IACxE,uEAAuE;IACvE,iEAAiE;IACjE,MAAM,SAAS,GAAsC;QACpD,GAAG,IAAI;QACP,WAAW,EAAE,kDAAkD;QAC/D,UAAU,EAAE,eAAe;QAC3B,gBAAgB,EAAE,SAAS;QAC3B,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CACjD,IAAI,CAAC,OAAO,CACX,UAAU,EACV,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,EACpF,MAAM,EACN,QAAQ,CACR;KACF,CAAC;IAEF,MAAM,SAAS,GAAsC;QACpD,GAAG,IAAI;QACP,WAAW,EAAE,8CAA8C;QAC3D,UAAU,EAAE,eAAe;KAC3B,CAAC;IAEF,OAAO;QACN,IAAI,EAAE,SAAsB;QAC5B,KAAK,EAAE,UAAuB;QAC9B,IAAI,EAAE,SAAsB;QAC5B,IAAI,EAAE,SAAsB;KAC5B,CAAC;AAAA,CACF;AAcD,wFAAwF;AACxF,SAAS,oBAAoB,CAAC,IAAY,EAAU;IACnD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAAA,CAClC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAc,EAAU;IAC/D,OAAO,oBAAoB,CAC1B,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAC/F,CAAC;AAAA,CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAIpC,EAAiB;IACjB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,OAAO;SACnB,WAAW,EAAE;SACb,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC5C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACtE,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3E,OAAO;QACN,kBAAkB;QAClB,gBAAgB;QAChB,WAAW,EAAE,kBAAkB,GAAG,gBAAgB;QAClD,KAAK;KACL,CAAC;AAAA,CACF","sourcesContent":["/**\n * Light mode — a minimal, low-token preset for small/local models.\n *\n * The preset restricts the session to the four core tools (read, write, edit,\n * bash) with shortened descriptions and undocumented parameter schemas,\n * replaces the default system prompt with a terse one, and disables\n * subagents, TodoWrite, skills, context files, and the mode-prompt appendix.\n * The goal is the smallest possible fixed per-turn surface (system prompt +\n * serialized tool schemas) so weak tool-callers waste no context on harness\n * boilerplate. bash subsumes grep/find/ls: search happens via the shell.\n */\n\nimport type { AgentTool } from \"@kolisachint/hoocode-agent-core\";\nimport { Type } from \"typebox\";\nimport type { ToolInfo } from \"./extensions/types.js\";\nimport { createBashTool, createEditTool, createReadTool, createWriteTool } from \"./tools/index.js\";\n\n/** The only tools a light session exposes. */\nexport const LIGHT_TOOL_NAMES = [\"read\", \"write\", \"edit\", \"bash\"] as const;\n\n/**\n * Terse replacement for the default system prompt. buildSystemPrompt appends\n * the current date and working directory; nothing else rides along because\n * light mode also disables skills, context files, and the mode appendix.\n */\nexport const LIGHT_SYSTEM_PROMPT = `You are a coding agent. Use the tools to read, edit, and write files and run shell commands.\nSearch with bash (grep/find/ls). Prefer edit for changes; write for new files.\nBe concise. No preamble.`;\n\n/**\n * Environment flag signaling light mode to code that cannot see CLI flags or\n * settings — notably the hoo-core modes extension, which reads it to skip the\n * `<!-- hoo-core: mode= -->` system-prompt appendix. Same pattern as\n * WARM_SUBAGENTS_ENV / SUBAGENT_MAX_DEPTH_ENV.\n */\nexport const LIGHT_MODE_ENV = \"HOOCODE_LIGHT\";\n\n/** Whether light mode was signaled through the environment. */\nexport function isLightModeEnv(): boolean {\n\treturn process.env[LIGHT_MODE_ENV] === \"1\";\n}\n\n// Light parameter schemas: same shapes the real tools accept, minus the\n// per-property descriptions (that is where most schema tokens live).\nconst lightReadSchema = Type.Object({\n\tpath: Type.String(),\n\toffset: Type.Optional(Type.Number()),\n\tlimit: Type.Optional(Type.Number()),\n});\n\nconst lightWriteSchema = Type.Object({\n\tpath: Type.String(),\n\tcontent: Type.String(),\n});\n\n// Flat single-replacement shape instead of the full edits[] batch schema. The\n// execute shim below converts it to the batch form the real edit tool expects.\nconst lightEditSchema = Type.Object({\n\tpath: Type.String(),\n\toldText: Type.String(),\n\tnewText: Type.String(),\n});\n\nconst lightBashSchema = Type.Object({\n\tcommand: Type.String(),\n\ttimeout: Type.Optional(Type.Number()),\n});\n\n/**\n * Build the four light tools for `baseToolsOverride`: the real tool\n * implementations wearing short descriptions and stripped parameter schemas.\n */\nexport function createLightTools(cwd: string): Record<string, AgentTool> {\n\tconst read = createReadTool(cwd);\n\tconst write = createWriteTool(cwd);\n\tconst edit = createEditTool(cwd);\n\tconst bash = createBashTool(cwd);\n\n\tconst lightRead: AgentTool<typeof lightReadSchema> = {\n\t\t...read,\n\t\tdescription: \"Read a file. args: path, offset?, limit?\",\n\t\tparameters: lightReadSchema,\n\t};\n\n\tconst lightWrite: AgentTool<typeof lightWriteSchema> = {\n\t\t...write,\n\t\tdescription: \"Write file (overwrites). args: path, content\",\n\t\tparameters: lightWriteSchema,\n\t};\n\n\t// The real edit tool validates against its edits[] schema after\n\t// prepareArguments runs, so the flat light shape must skip the original\n\t// prepareArguments (validation sees the raw flat args against the flat\n\t// schema) and convert to the batch form at execute time instead.\n\tconst lightEdit: AgentTool<typeof lightEditSchema> = {\n\t\t...edit,\n\t\tdescription: \"Replace exact text. args: path, oldText, newText\",\n\t\tparameters: lightEditSchema,\n\t\tprepareArguments: undefined,\n\t\texecute: (toolCallId, params, signal, onUpdate) =>\n\t\t\tedit.execute(\n\t\t\t\ttoolCallId,\n\t\t\t\t{ path: params.path, edits: [{ oldText: params.oldText, newText: params.newText }] },\n\t\t\t\tsignal,\n\t\t\t\tonUpdate,\n\t\t\t),\n\t};\n\n\tconst lightBash: AgentTool<typeof lightBashSchema> = {\n\t\t...bash,\n\t\tdescription: \"Run a shell command. args: command, timeout?\",\n\t\tparameters: lightBashSchema,\n\t};\n\n\treturn {\n\t\tread: lightRead as AgentTool,\n\t\twrite: lightWrite as AgentTool,\n\t\tedit: lightEdit as AgentTool,\n\t\tbash: lightBash as AgentTool,\n\t};\n}\n\n/** Token breakdown of a session's fixed per-turn surface. */\nexport interface PromptSurface {\n\t/** Estimated tokens in the assembled system prompt. */\n\tsystemPromptTokens: number;\n\t/** Estimated tokens across the serialized active tool schemas. */\n\ttoolSchemaTokens: number;\n\t/** systemPromptTokens + toolSchemaTokens. */\n\ttotalTokens: number;\n\t/** Per-tool breakdown of the serialized schema estimate. */\n\ttools: Array<{ name: string; tokens: number }>;\n}\n\n/** Same conservative chars/4 heuristic the agent harness uses for context estimates. */\nfunction estimateStringTokens(text: string): number {\n\treturn Math.ceil(text.length / 4);\n}\n\n/**\n * What one tool costs on every request: its serialized `{name, description,\n * parameters}`, the three fields a provider re-sends each turn.\n *\n * Exported because the surface is worth showing for a tool that is *off* too —\n * `/settings` prices each toggle with it, and a disabled tool has no entry in a\n * measured surface precisely because it currently costs nothing.\n */\nexport function measureToolSchemaTokens(tool: ToolInfo): number {\n\treturn estimateStringTokens(\n\t\tJSON.stringify({ name: tool.name, description: tool.description, parameters: tool.parameters }),\n\t);\n}\n\n/**\n * Measure the fixed per-turn surface a session sends on every request: the\n * assembled system prompt plus the serialized schemas (name, description,\n * parameters) of the active tools. Providers add their own envelope on top,\n * so treat the result as a floor estimate.\n */\nexport function measurePromptSurface(session: {\n\tsystemPrompt: string;\n\tgetActiveToolNames(): string[];\n\tgetAllTools(): ToolInfo[];\n}): PromptSurface {\n\tconst activeNames = new Set(session.getActiveToolNames());\n\tconst tools = session\n\t\t.getAllTools()\n\t\t.filter((tool) => activeNames.has(tool.name))\n\t\t.map((tool) => ({ name: tool.name, tokens: measureToolSchemaTokens(tool) }));\n\tconst systemPromptTokens = estimateStringTokens(session.systemPrompt);\n\tconst toolSchemaTokens = tools.reduce((sum, tool) => sum + tool.tokens, 0);\n\treturn {\n\t\tsystemPromptTokens,\n\t\ttoolSchemaTokens,\n\t\ttotalTokens: systemPromptTokens + toolSchemaTokens,\n\t\ttools,\n\t};\n}\n"]}

package/dist/core/mode-prompts.d.ts

@@ -5,12 +5,24 @@
  * modes (ask / plan / build / debug). They are resolved only when a project or
  * user has not supplied a `modes/{name}/system.md` override.
  *
- * Extracted into a standalone module (instead of living inside the internal
- * `hoo-core` extension's `modes` module) so downstream apps embedding hoocode can import,
+ * The prompts themselves live in `templates/modes/<mode>/system.md` and reach
+ * this module through the build-time embed. They used to be a second, hand-
+ * written copy right here, and the two had already drifted: `/init` scaffolds
+ * the template copy into a project, so a user who ran it got one set of mode
+ * rules and a user who did not got another, differently worded set. Prose has
+ * one home now; this module is the typed accessor for it.
+ *
+ * Kept as a standalone module (rather than living inside the internal `hoo-core`
+ * extension's `modes` module) so downstream apps embedding hoocode can import,
  * inspect, and extend the shipped prompts without copy-pasting them.
  */
 /** Mode used when no `active_mode` is configured. */
 export declare const DEFAULT_MODE = "build";
-/** Built-in fallback system prompts keyed by mode name. */
+/**
+ * Built-in fallback system prompts keyed by mode name.
+ *
+ * The plan-mode prompt carries a `{{PLAN_PATH}}` token that the mode extension
+ * substitutes per session; a consumer rendering these itself must do the same.
+ */
 export declare const DEFAULT_MODE_PROMPTS: Record<string, string>;
 //# sourceMappingURL=mode-prompts.d.ts.map

package/dist/core/mode-prompts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mode-prompts.d.ts","sourceRoot":"","sources":["../../src/core/mode-prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,qDAAqD;AACrD,eAAO,MAAM,YAAY,UAAU,CAAC;AAEpC,2DAA2D;AAC3D,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CA4BvD,CAAC","sourcesContent":["/**\n * Canonical built-in mode prompts and the default active mode.\n *\n * These are the fallback system prompts hoocode ships for its four built-in\n * modes (ask / plan / build / debug). They are resolved only when a project or\n * user has not supplied a `modes/{name}/system.md` override.\n *\n * Extracted into a standalone module (instead of living inside the internal\n * `hoo-core` extension's `modes` module) so downstream apps embedding hoocode can import,\n * inspect, and extend the shipped prompts without copy-pasting them.\n */\n\n/** Mode used when no `active_mode` is configured. */\nexport const DEFAULT_MODE = \"build\";\n\n/** Built-in fallback system prompts keyed by mode name. */\nexport const DEFAULT_MODE_PROMPTS: Record<string, string> = {\n\task: `You are in ASK mode — read-only Q&A.\nAnswer questions about the codebase. Trace logic, compare approaches, explain patterns.\nYou may read any file but NEVER write, edit, or execute commands.\nIf asked to make changes, refuse and suggest switching to /mode build.\nCite specific file paths and line numbers in your answers.`,\n\n\tplan: `You are in PLAN mode — exploration and planning.\nExplore the codebase thoroughly. Understand the current structure.\nDraft a complete plan with sections: Goal, Files to modify, New files, Tests, Verification.\nWrite the plan to {{PLAN_PATH}}.\nWhen the plan is complete, tell the user their options: /grill to stress-test it\nfirst, then /approve to execute it step by step or /goal to work toward it\nautonomously. Recommend /grill when the plan carries real risk.`,\n\n\tbuild: `You are in BUILD mode — careful implementation.\nRead files before editing them. Show diffs before non-trivial changes.\nAsk for confirmation before destructive operations (delete, reformat).\nRun tests after every logical unit of work.\nPrefer the smallest change that achieves the goal.\nFollow existing code patterns and conventions.`,\n\n\tdebug: `You are in DEBUG mode — root cause analysis.\nGather evidence: read files, check logs, reproduce the issue.\nTrace the call path from entry to failure point.\nState the root cause in one sentence.\nDescribe the fix precisely but do NOT apply it.\nTo fix, switch to /mode build.`,\n};\n"]}
+{"version":3,"file":"mode-prompts.d.ts","sourceRoot":"","sources":["../../src/core/mode-prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,qDAAqD;AACrD,eAAO,MAAM,YAAY,UAAU,CAAC;AAEpC;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAkB,CAAC","sourcesContent":["/**\n * Canonical built-in mode prompts and the default active mode.\n *\n * These are the fallback system prompts hoocode ships for its four built-in\n * modes (ask / plan / build / debug). They are resolved only when a project or\n * user has not supplied a `modes/{name}/system.md` override.\n *\n * The prompts themselves live in `templates/modes/<mode>/system.md` and reach\n * this module through the build-time embed. They used to be a second, hand-\n * written copy right here, and the two had already drifted: `/init` scaffolds\n * the template copy into a project, so a user who ran it got one set of mode\n * rules and a user who did not got another, differently worded set. Prose has\n * one home now; this module is the typed accessor for it.\n *\n * Kept as a standalone module (rather than living inside the internal `hoo-core`\n * extension's `modes` module) so downstream apps embedding hoocode can import,\n * inspect, and extend the shipped prompts without copy-pasting them.\n */\n\nimport { EMBEDDED_MODES } from \"../init-templates.generated.js\";\n\n/** Mode used when no `active_mode` is configured. */\nexport const DEFAULT_MODE = \"build\";\n\n/**\n * Built-in fallback system prompts keyed by mode name.\n *\n * The plan-mode prompt carries a `{{PLAN_PATH}}` token that the mode extension\n * substitutes per session; a consumer rendering these itself must do the same.\n */\nexport const DEFAULT_MODE_PROMPTS: Record<string, string> = EMBEDDED_MODES;\n"]}

package/dist/core/mode-prompts.js

@@ -5,37 +5,25 @@
  * modes (ask / plan / build / debug). They are resolved only when a project or
  * user has not supplied a `modes/{name}/system.md` override.
  *
- * Extracted into a standalone module (instead of living inside the internal
- * `hoo-core` extension's `modes` module) so downstream apps embedding hoocode can import,
+ * The prompts themselves live in `templates/modes/<mode>/system.md` and reach
+ * this module through the build-time embed. They used to be a second, hand-
+ * written copy right here, and the two had already drifted: `/init` scaffolds
+ * the template copy into a project, so a user who ran it got one set of mode
+ * rules and a user who did not got another, differently worded set. Prose has
+ * one home now; this module is the typed accessor for it.
+ *
+ * Kept as a standalone module (rather than living inside the internal `hoo-core`
+ * extension's `modes` module) so downstream apps embedding hoocode can import,
  * inspect, and extend the shipped prompts without copy-pasting them.
  */
+import { EMBEDDED_MODES } from "../init-templates.generated.js";
 /** Mode used when no `active_mode` is configured. */
 export const DEFAULT_MODE = "build";
-/** Built-in fallback system prompts keyed by mode name. */
-export const DEFAULT_MODE_PROMPTS = {
-    ask: `You are in ASK mode — read-only Q&A.
-Answer questions about the codebase. Trace logic, compare approaches, explain patterns.
-You may read any file but NEVER write, edit, or execute commands.
-If asked to make changes, refuse and suggest switching to /mode build.
-Cite specific file paths and line numbers in your answers.`,
-    plan: `You are in PLAN mode — exploration and planning.
-Explore the codebase thoroughly. Understand the current structure.
-Draft a complete plan with sections: Goal, Files to modify, New files, Tests, Verification.
-Write the plan to {{PLAN_PATH}}.
-When the plan is complete, tell the user their options: /grill to stress-test it
-first, then /approve to execute it step by step or /goal to work toward it
-autonomously. Recommend /grill when the plan carries real risk.`,
-    build: `You are in BUILD mode — careful implementation.
-Read files before editing them. Show diffs before non-trivial changes.
-Ask for confirmation before destructive operations (delete, reformat).
-Run tests after every logical unit of work.
-Prefer the smallest change that achieves the goal.
-Follow existing code patterns and conventions.`,
-    debug: `You are in DEBUG mode — root cause analysis.
-Gather evidence: read files, check logs, reproduce the issue.
-Trace the call path from entry to failure point.
-State the root cause in one sentence.
-Describe the fix precisely but do NOT apply it.
-To fix, switch to /mode build.`,
-};
+/**
+ * Built-in fallback system prompts keyed by mode name.
+ *
+ * The plan-mode prompt carries a `{{PLAN_PATH}}` token that the mode extension
+ * substitutes per session; a consumer rendering these itself must do the same.
+ */
+export const DEFAULT_MODE_PROMPTS = EMBEDDED_MODES;
 //# sourceMappingURL=mode-prompts.js.map

package/dist/core/mode-prompts.js.map

@@ -1 +1 @@
-{"version":3,"file":"mode-prompts.js","sourceRoot":"","sources":["../../src/core/mode-prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,qDAAqD;AACrD,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC;AAEpC,2DAA2D;AAC3D,MAAM,CAAC,MAAM,oBAAoB,GAA2B;IAC3D,GAAG,EAAE;;;;2DAIqD;IAE1D,IAAI,EAAE;;;;;;gEAMyD;IAE/D,KAAK,EAAE;;;;;+CAKuC;IAE9C,KAAK,EAAE;;;;;+BAKuB;CAC9B,CAAC","sourcesContent":["/**\n * Canonical built-in mode prompts and the default active mode.\n *\n * These are the fallback system prompts hoocode ships for its four built-in\n * modes (ask / plan / build / debug). They are resolved only when a project or\n * user has not supplied a `modes/{name}/system.md` override.\n *\n * Extracted into a standalone module (instead of living inside the internal\n * `hoo-core` extension's `modes` module) so downstream apps embedding hoocode can import,\n * inspect, and extend the shipped prompts without copy-pasting them.\n */\n\n/** Mode used when no `active_mode` is configured. */\nexport const DEFAULT_MODE = \"build\";\n\n/** Built-in fallback system prompts keyed by mode name. */\nexport const DEFAULT_MODE_PROMPTS: Record<string, string> = {\n\task: `You are in ASK mode — read-only Q&A.\nAnswer questions about the codebase. Trace logic, compare approaches, explain patterns.\nYou may read any file but NEVER write, edit, or execute commands.\nIf asked to make changes, refuse and suggest switching to /mode build.\nCite specific file paths and line numbers in your answers.`,\n\n\tplan: `You are in PLAN mode — exploration and planning.\nExplore the codebase thoroughly. Understand the current structure.\nDraft a complete plan with sections: Goal, Files to modify, New files, Tests, Verification.\nWrite the plan to {{PLAN_PATH}}.\nWhen the plan is complete, tell the user their options: /grill to stress-test it\nfirst, then /approve to execute it step by step or /goal to work toward it\nautonomously. Recommend /grill when the plan carries real risk.`,\n\n\tbuild: `You are in BUILD mode — careful implementation.\nRead files before editing them. Show diffs before non-trivial changes.\nAsk for confirmation before destructive operations (delete, reformat).\nRun tests after every logical unit of work.\nPrefer the smallest change that achieves the goal.\nFollow existing code patterns and conventions.`,\n\n\tdebug: `You are in DEBUG mode — root cause analysis.\nGather evidence: read files, check logs, reproduce the issue.\nTrace the call path from entry to failure point.\nState the root cause in one sentence.\nDescribe the fix precisely but do NOT apply it.\nTo fix, switch to /mode build.`,\n};\n"]}
+{"version":3,"file":"mode-prompts.js","sourceRoot":"","sources":["../../src/core/mode-prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,qDAAqD;AACrD,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA2B,cAAc,CAAC","sourcesContent":["/**\n * Canonical built-in mode prompts and the default active mode.\n *\n * These are the fallback system prompts hoocode ships for its four built-in\n * modes (ask / plan / build / debug). They are resolved only when a project or\n * user has not supplied a `modes/{name}/system.md` override.\n *\n * The prompts themselves live in `templates/modes/<mode>/system.md` and reach\n * this module through the build-time embed. They used to be a second, hand-\n * written copy right here, and the two had already drifted: `/init` scaffolds\n * the template copy into a project, so a user who ran it got one set of mode\n * rules and a user who did not got another, differently worded set. Prose has\n * one home now; this module is the typed accessor for it.\n *\n * Kept as a standalone module (rather than living inside the internal `hoo-core`\n * extension's `modes` module) so downstream apps embedding hoocode can import,\n * inspect, and extend the shipped prompts without copy-pasting them.\n */\n\nimport { EMBEDDED_MODES } from \"../init-templates.generated.js\";\n\n/** Mode used when no `active_mode` is configured. */\nexport const DEFAULT_MODE = \"build\";\n\n/**\n * Built-in fallback system prompts keyed by mode name.\n *\n * The plan-mode prompt carries a `{{PLAN_PATH}}` token that the mode extension\n * substitutes per session; a consumer rendering these itself must do the same.\n */\nexport const DEFAULT_MODE_PROMPTS: Record<string, string> = EMBEDDED_MODES;\n"]}

package/dist/core/tools/propose-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"propose-plugin.d.ts","sourceRoot":"","sources":["../../../src/core/tools/propose-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAoBH,OAAO,EAAc,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAsPzE,wBAAgB,iCAAiC,IAAI,cAAc,CA+ElE;AASD,wBAAgB,gCAAgC,IAAI,cAAc,CAkEjE;AAmCD,wBAAgB,0CAA0C,IAAI,cAAc,CAiE3E;AAED,qFAAqF;AACrF,wBAAgB,kCAAkC,IAAI,cAAc,EAAE,CAMrE","sourcesContent":["/**\n * Capability authoring tools (spec §3), refactored to a single risk-gated path.\n *\n *   ProposePlugin  author a NEW plugin from any capability mix — skills,\n *                  commands, subagents, hooks, MCP servers. The risk gate is\n *                  *computed from content*, not pre-declared by tool choice:\n *                  passive content (skills, commands, read-only subagents) is\n *                  authored autonomously; executable content (hooks, MCP servers,\n *                  mutating/high-privilege subagents) auto-triggers a \"show the\n *                  code + tool grant → human confirms → activate\" gate in the\n *                  same call. A mixed plugin (skill + hook) is authored in one\n *                  call, and a hook can never be mis-routed through a \"passive\"\n *                  tool because the gate keys off what the draft contains.\n *   UpdatePlugin   merge inline-authored capabilities into an EXISTING local\n *                  plugin. Nothing is fetched from a remote, so the supply-chain\n *                  \"benign v1 → hostile v2\" risk that keeps a marketplace\n *                  UpdatePlugin out of the model's hands does not apply here;\n *                  executable additions still pass through the same confirm gate.\n *\n * Both author into `.agents/plugins/<id>/` in the requested vendor layouts\n * (Claude Code + GitHub Copilot by default) via the format registry, so results\n * are proper, publishable plugins that round-trip through parsePluginDir.\n *\n * Privilege-amplification guardrail: an authored subagent may never carry a\n * plugin-system (capability-acquisition) tool in its allowlist — enforced in\n * both tools — so a low-trust authored agent cannot bootstrap privilege.\n */\n\nimport { type Static, Type } from \"typebox\";\nimport {\n\tclassifyAllowlist,\n\tgetPlugin,\n\tisAuthoredPlugin,\n\tmergePluginDraft,\n\tpluginExists,\n\tpromoteDraft,\n\tremoveFromPlugin,\n\tresolvePluginPlatforms,\n\twritePluginDraft,\n} from \"../extensions/plugins/authoring.js\";\nimport type { PluginPlatform } from \"../extensions/plugins/formats/platform-targets.js\";\nimport type { MarketplacePlatform, PluginDraft } from \"../extensions/plugins/formats/types.js\";\nimport { formatGateFindings, runStaticGates, withFindings } from \"../extensions/plugins/gates.js\";\nimport { discardDraftDir } from \"../extensions/plugins/locations.js\";\nimport { runSmokeGate } from \"../extensions/plugins/smoke.js\";\nimport type { ExtensionContext } from \"../extensions/types.js\";\nimport { defineTool, type ToolDefinition } from \"../extensions/types.js\";\nimport {\n\tPROPOSE_PLUGIN_TOOL_NAME,\n\tREMOVE_PLUGIN_CAPABILITY_TOOL_NAME,\n\tUPDATE_PLUGIN_TOOL_NAME,\n} from \"./plugin-tool-names.js\";\n\nconst skillSchema = Type.Object(\n\t{\n\t\tname: Type.String({ description: \"Skill name.\" }),\n\t\tdescription: Type.Optional(Type.String({ description: \"One-line trigger description (kept lazy in context).\" })),\n\t\tbody: Type.String({ description: \"SKILL.md instruction body (markdown).\" }),\n\t},\n\t{ additionalProperties: false },\n);\n\nconst commandSchema = Type.Object(\n\t{\n\t\tname: Type.String({ description: \"Command name (invoked as /name).\" }),\n\t\tdescription: Type.Optional(Type.String({ description: \"One-line description.\" })),\n\t\tbody: Type.String({ description: \"Prompt template body (markdown).\" }),\n\t},\n\t{ additionalProperties: false },\n);\n\nconst subagentSchema = Type.Object(\n\t{\n\t\tname: Type.String({ description: \"Subagent name.\" }),\n\t\tdescription: Type.Optional(Type.String({ description: \"When to dispatch this subagent.\" })),\n\t\ttools: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tdescription:\n\t\t\t\t\t\"Comma-separated allowed-tools, e.g. 'read, grep, glob'. Read-only grants are autonomous; \" +\n\t\t\t\t\t\"mutating/exec/network grants (Bash, Write, Edit, MCP) or '*' require human confirmation. Omit for none.\",\n\t\t\t}),\n\t\t),\n\t\tmodel: Type.Optional(Type.String({ description: \"Model override, or 'inherit'.\" })),\n\t\tbody: Type.String({ description: \"System-prompt / instruction body (markdown).\" }),\n\t},\n\t{ additionalProperties: false },\n);\n\nconst hookSchema = Type.Object(\n\t{\n\t\tevent: Type.String({ description: \"Event: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, Stop, ...\" }),\n\t\tmatcher: Type.Optional(Type.String({ description: \"Regex matched against the tool name. Empty/'*' = all.\" })),\n\t\tcommand: Type.String({ description: \"Shell command to run on the event.\" }),\n\t\ttimeout: Type.Optional(Type.Number({ description: \"Timeout in seconds.\" })),\n\t},\n\t{ additionalProperties: false },\n);\n\nconst mcpServerSchema = Type.Object(\n\t{\n\t\tname: Type.String({ description: \"MCP server name.\" }),\n\t\tcommand: Type.String({ description: \"Executable to launch the server.\" }),\n\t\targs: Type.Optional(Type.Array(Type.String(), { description: \"Command arguments.\" })),\n\t\tenv: Type.Optional(Type.Record(Type.String(), Type.String(), { description: \"Environment variables.\" })),\n\t},\n\t{ additionalProperties: false },\n);\n\n/** The capability params shared by ProposePlugin (create) and UpdatePlugin (merge). */\nconst capabilityProps = {\n\tdescription: Type.Optional(Type.String({ description: \"Plugin description.\" })),\n\tversion: Type.Optional(Type.String({ description: \"Plugin version, e.g. '0.1.0'.\" })),\n\tskills: Type.Optional(Type.Array(skillSchema)),\n\tcommands: Type.Optional(Type.Array(commandSchema)),\n\tsubagents: Type.Optional(\n\t\tType.Array(subagentSchema, {\n\t\t\tdescription: \"Subagents. Read-only allowlists are autonomous; mutating ones trigger human confirmation.\",\n\t\t}),\n\t),\n\thooks: Type.Optional(Type.Array(hookSchema, { description: \"Shell hooks (executable — trigger confirmation).\" })),\n\tmcpServers: Type.Optional(\n\t\tType.Array(mcpServerSchema, { description: \"MCP servers (executable — trigger confirmation).\" }),\n\t),\n} as const;\n\n/** Union of every capability a draft can carry (used to build a draft and to classify risk). */\ninterface CapabilityInput {\n\tdescription?: string;\n\tversion?: string;\n\tskills?: Static<typeof skillSchema>[];\n\tcommands?: Static<typeof commandSchema>[];\n\tsubagents?: Static<typeof subagentSchema>[];\n\thooks?: Static<typeof hookSchema>[];\n\tmcpServers?: Static<typeof mcpServerSchema>[];\n}\n\nfunction resolvePlatforms(): PluginPlatform[] {\n\t// No model-facing platform selection: the human picks the target ecosystem\n\t// with --platform, defaulting to claude. A plugin is a distribution unit, so\n\t// there is no vendor-neutral option here. See resolvePluginPlatforms.\n\treturn resolvePluginPlatforms();\n}\n\nfunction draftFrom(id: string, params: CapabilityInput, platforms: MarketplacePlatform[]): PluginDraft {\n\treturn {\n\t\tid,\n\t\tversion: params.version,\n\t\tdescription: params.description,\n\t\tsupportPlatform: platforms,\n\t\tskills: params.skills,\n\t\tcommands: params.commands,\n\t\tagents: params.subagents,\n\t\thooks: params.hooks,\n\t\tmcpServers: params.mcpServers,\n\t};\n}\n\n/** Total capabilities carried by the draft (empty arrays count as nothing). */\nfunction capabilityCount(params: CapabilityInput): number {\n\treturn (\n\t\t(params.skills?.length ?? 0) +\n\t\t(params.commands?.length ?? 0) +\n\t\t(params.subagents?.length ?? 0) +\n\t\t(params.hooks?.length ?? 0) +\n\t\t(params.mcpServers?.length ?? 0)\n\t);\n}\n\n/** The subagents whose allowlist makes them mutating/high-privilege (need the confirm gate). */\nfunction mutatingSubagents(params: CapabilityInput): Static<typeof subagentSchema>[] {\n\treturn (params.subagents ?? []).filter((sa) => classifyAllowlist(sa.tools).risk === \"mutating\");\n}\n\n/** True when the draft carries anything executable — hooks, MCP servers, or a mutating subagent. */\nfunction hasExecutable(params: CapabilityInput): boolean {\n\treturn (\n\t\t(params.hooks?.length ?? 0) > 0 || (params.mcpServers?.length ?? 0) > 0 || mutatingSubagents(params).length > 0\n\t);\n}\n\n/** Reject if any subagent carries a plugin-system tool (privilege-amplification guardrail). Returns the message, or null. */\nfunction guardrailViolation(params: CapabilityInput): string | null {\n\tfor (const sa of params.subagents ?? []) {\n\t\tconst cls = classifyAllowlist(sa.tools);\n\t\tif (cls.pluginTools.length > 0) {\n\t\t\treturn (\n\t\t\t\t`Subagent \"${sa.name}\" requests plugin-system tools (${cls.pluginTools.join(\", \")}). ` +\n\t\t\t\t\"Authored subagents may never carry capability-acquisition tools.\"\n\t\t\t);\n\t\t}\n\t}\n\treturn null;\n}\n\n/** Build the human-facing review text: the executable code and every mutating tool grant. */\nfunction buildReview(id: string, params: CapabilityInput): string {\n\tconst lines: string[] = [`Plugin \"${id}\" wants to install executable capabilities:`];\n\tfor (const h of params.hooks ?? []) {\n\t\tlines.push(`  hook [${h.event}${h.matcher ? ` matcher=${h.matcher}` : \"\"}]: ${h.command}`);\n\t}\n\tfor (const s of params.mcpServers ?? []) {\n\t\tlines.push(`  mcp server \"${s.name}\": ${s.command}${s.args?.length ? ` ${s.args.join(\" \")}` : \"\"}`);\n\t}\n\tfor (const sa of mutatingSubagents(params)) {\n\t\tlines.push(`  subagent \"${sa.name}\" tools: ${sa.tools ?? \"(none)\"} (${classifyAllowlist(sa.tools).reason})`);\n\t}\n\treturn lines.join(\"\\n\");\n}\n\nfunction summarizeWrite(\n\tid: string,\n\tplatforms: MarketplacePlatform[],\n\tfiles: string[],\n\tdest: string,\n\tverb: string,\n): string {\n\treturn (\n\t\t`${verb} plugin \"${id}\" (${platforms.join(\", \")}) with ${files.length} file(s) at ${dest}:\\n` +\n\t\tfiles.map((f) => `  ${f}`).join(\"\\n\") +\n\t\t`\\nRemove it with UninstallPlugin.`\n\t);\n}\n\ninterface AuthorPluginDetails {\n\tid: string;\n\tauthored: boolean;\n\t/** Whether an executable-capability confirmation gate ran (and was accepted). */\n\tconfirmed?: boolean;\n}\n\nfunction reject(\n\tid: string,\n\tmessage: string,\n): {\n\tcontent: { type: \"text\"; text: string }[];\n\tdetails: AuthorPluginDetails;\n} {\n\treturn { content: [{ type: \"text\" as const, text: message }], details: { id, authored: false } };\n}\n\n/**\n * Run the shared \"executable capabilities → show → confirm\" gate. Returns:\n *  - `{ ok: true }` when there is nothing executable, or the human confirmed;\n *  - a tool result (authored:false) when there is no UI to confirm on, or the\n *    human declined.\n */\nasync function passExecutableGate(\n\tid: string,\n\tparams: CapabilityInput,\n\tctx: ExtensionContext,\n\tevidence?: string,\n): Promise<{ ok: true; gated: boolean } | { ok: false; result: ReturnType<typeof reject> }> {\n\tif (!hasExecutable(params)) return { ok: true, gated: false };\n\n\t// The gate results go in the prompt, not just the tool result. A human shown a\n\t// bare shell command has no basis to approve it; \"ran the checks, here is what\n\t// they found\" is what makes the confirmation a decision rather than a formality.\n\tconst review = evidence ? `${buildReview(id, params)}\\n\\n${evidence}` : buildReview(id, params);\n\tctx.ui.notify(review, \"warning\");\n\tif (!ctx.hasUI) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\tresult: reject(\n\t\t\t\tid,\n\t\t\t\t\"Authoring executable capabilities requires human confirmation, which is unavailable in this mode. \" +\n\t\t\t\t\t`Not activated.\\n${review}`,\n\t\t\t),\n\t\t};\n\t}\n\tconst confirmed = await ctx.ui.confirm(\n\t\t`Author executable plugin \"${id}\"?`,\n\t\t`${review}\\n\\nThis installs and can run the code above. Activate it?`,\n\t);\n\tif (!confirmed) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\tresult: {\n\t\t\t\tcontent: [{ type: \"text\" as const, text: `Declined — plugin \"${id}\" was not authored.` }],\n\t\t\t\tdetails: { id, authored: false, confirmed: false },\n\t\t\t},\n\t\t};\n\t}\n\treturn { ok: true, gated: true };\n}\n\n// ── ProposePlugin (create) ────────────────────────────────────────────────────\n\nconst proposeParams = Type.Object(\n\t{ id: Type.String({ description: \"Plugin id (directory + manifest name).\" }), ...capabilityProps },\n\t{ additionalProperties: false },\n);\n\nexport function createProposePluginToolDefinition(): ToolDefinition {\n\treturn defineTool<typeof proposeParams, AuthorPluginDetails>({\n\t\tname: PROPOSE_PLUGIN_TOOL_NAME,\n\t\tlabel: PROPOSE_PLUGIN_TOOL_NAME,\n\t\tdescription:\n\t\t\t\"Author a NEW portable, reusable plugin to fill a capability gap when no marketplace plugin fits. Accepts any \" +\n\t\t\t\"capability mix — skills, slash commands, subagents, hooks, MCP servers. Authored as one self-contained \" +\n\t\t\t\"artifact usable across sessions and projects. Passive content (skills, commands, read-only \" +\n\t\t\t\"subagents) is authored autonomously; executable content (hooks, MCP servers, mutating subagents) is shown \" +\n\t\t\t\"and requires human confirmation before it activates. To change an existing plugin, use UpdatePlugin.\",\n\t\tpromptSnippet:\n\t\t\t\"Author a new portable, reusable plugin to fill a capability gap (passive is autonomous; executable asks to confirm).\",\n\t\tpromptGuidelines: [\n\t\t\t\"Sense reusability proactively: when you complete a multi-step recipe you'd plausibly repeat (or repeat the same pattern twice in one session) and SearchPlugins finds nothing that covers it, author it with ProposePlugin. Name and describe it by the capability, not the one-off task that prompted it, so it triggers again in other contexts. Passive skills/commands activate immediately and are reversible with UninstallPlugin — announce what you created and why.\",\n\t\t\t\"Author for portability: write self-contained content — no absolute or machine-specific paths, no embedded secrets or environment-specific values, no assumptions about the current repo unless that is the capability's point. Prefer relative paths and runtime discovery, and state any prerequisites in the body. The layout is the session's target platform; you never choose it.\",\n\t\t\t\"One tool for the whole plugin: put skills + a hook in a single call. The risk gate is computed from content — you don't pre-classify. Read-only subagents and skills/commands go straight through; hooks, MCP servers, or a subagent needing Bash/Write/Edit/MCP or tools:* pause for human confirmation.\",\n\t\t\t\"Never grant a subagent any plugin-system tool (InstallPlugin, ProposePlugin, ...); that is always rejected.\",\n\t\t\t\"Publishing a proven-useful plugin to a marketplace stays a human action — do not do it autonomously.\",\n\t\t],\n\t\tparameters: proposeParams,\n\t\tasync execute(_id, params: Static<typeof proposeParams>, _signal, _onUpdate, ctx: ExtensionContext) {\n\t\t\tconst violation = guardrailViolation(params);\n\t\t\tif (violation) return reject(params.id, violation);\n\n\t\t\tif (capabilityCount(params) === 0) {\n\t\t\t\treturn reject(params.id, \"Nothing to author. Provide skills, commands, subagents, hooks, or mcpServers.\");\n\t\t\t}\n\n\t\t\tconst platforms = resolvePlatforms();\n\t\t\t// Scoped to the target platform's home: the same id on another platform is\n\t\t\t// a separate ecosystem artifact, not a duplicate.\n\t\t\tif (pluginExists(params.id, platforms)) {\n\t\t\t\treturn reject(\n\t\t\t\t\tparams.id,\n\t\t\t\t\t`A ${platforms.join(\"/\")} plugin named \"${params.id}\" already exists. ` +\n\t\t\t\t\t\t\"Use UpdatePlugin to change it, or pick another id.\",\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// Emit to an ephemeral draft first: the gates need something real to run\n\t\t\t// against, and a production home is live (Claude Code loads\n\t\t\t// ~/.claude/skills on its next session), so nothing may land there until\n\t\t\t// the checks pass and — for executable content — the human agrees.\n\t\t\tconst draft = writePluginDraft(draftFrom(params.id, params, platforms), platforms, { promote: false });\n\t\t\tlet evaluation = runStaticGates(draft.dest, { platform: platforms[0] });\n\t\t\t// G3 only for executable content, and only once the cheap gates are\n\t\t\t// happy: no point running a hook whose command G2 already rejected.\n\t\t\tif (evaluation.ok && evaluation.plugin && hasExecutable(params)) {\n\t\t\t\tevaluation = withFindings(evaluation, await runSmokeGate(evaluation.plugin));\n\t\t\t}\n\t\t\tif (!evaluation.ok) {\n\t\t\t\tdiscardDraftDir(draft.dest);\n\t\t\t\treturn reject(\n\t\t\t\t\tparams.id,\n\t\t\t\t\t`Plugin \"${params.id}\" was not authored — it failed its checks.\\n` +\n\t\t\t\t\t\t`${formatGateFindings(evaluation)}\\nFix the issues and try again.`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst gate = await passExecutableGate(params.id, params, ctx, formatGateFindings(evaluation));\n\t\t\tif (!gate.ok) {\n\t\t\t\tdiscardDraftDir(draft.dest);\n\t\t\t\treturn gate.result;\n\t\t\t}\n\n\t\t\tconst dest = promoteDraft(draft.dest, params.id, platforms);\n\t\t\t// Passive capabilities activate live — usable on the very next model request,\n\t\t\t// this same turn; hooks/MCP servers activate via the reload once the turn ends.\n\t\t\tconst activation = ctx.activatePlugin(dest);\n\t\t\tconst text =\n\t\t\t\t`${summarizeWrite(params.id, platforms, draft.files, dest, \"Authored\")}\\n` +\n\t\t\t\t`${formatGateFindings(evaluation)}\\n${activation.message}`;\n\t\t\tctx.ui.notify(`Authored plugin \"${params.id}\" (${platforms.join(\", \")}).`, \"info\");\n\t\t\treturn {\n\t\t\t\tcontent: [{ type: \"text\" as const, text }],\n\t\t\t\tdetails: { id: params.id, authored: true, confirmed: gate.gated },\n\t\t\t};\n\t\t},\n\t});\n}\n\n// ── UpdatePlugin (merge into an existing local plugin) ─────────────────────────\n\nconst updateParams = Type.Object(\n\t{ id: Type.String({ description: \"Id of the existing local plugin to update.\" }), ...capabilityProps },\n\t{ additionalProperties: false },\n);\n\nexport function createUpdatePluginToolDefinition(): ToolDefinition {\n\treturn defineTool<typeof updateParams, AuthorPluginDetails>({\n\t\tname: UPDATE_PLUGIN_TOOL_NAME,\n\t\tlabel: UPDATE_PLUGIN_TOOL_NAME,\n\t\tdescription:\n\t\t\t\"Merge inline-authored capabilities into an EXISTING locally AUTHORED plugin (marketplace-installed plugins \" +\n\t\t\t\"are refused). Skills/commands/subagents are added or replaced by name; hooks and MCP servers are unioned \" +\n\t\t\t\"with what's already there; metadata is overwritten only where you supply it. Additive only — remove a \" +\n\t\t\t\"capability with RemovePluginCapability. Nothing is fetched from a remote. Keep additions as portable as \" +\n\t\t\t\"the original, and in its existing layout. Passive additions apply autonomously; executable additions (hooks, MCP \" +\n\t\t\t\"servers, mutating subagents) require human confirmation. Use ProposePlugin to create.\",\n\t\tpromptSnippet:\n\t\t\t\"Add/replace capabilities in a portable plugin you authored (additive; executable additions ask to confirm).\",\n\t\tpromptGuidelines: [\n\t\t\t\"Use UpdatePlugin to grow a plugin you already authored — e.g. add a skill to it, or attach a hook. Supply only the delta; existing capabilities are preserved (a matching name replaces just that one). It cannot remove a capability — use RemovePluginCapability for that.\",\n\t\t\t\"Keep additions portable: same content rules as ProposePlugin — no absolute paths, no secrets, capability-not-task naming.\",\n\t\t\t\"Hooks cannot be modified in place: they have no name, so supplying a changed command ADDS a second hook alongside the old one (both fire). To change a hook, RemovePluginCapability the old one first, then add the new one here.\",\n\t\t\t\"Only executable *additions* trigger confirmation — adding a passive skill to an already-executable plugin does not re-prompt.\",\n\t\t\t\"Never grant a subagent any plugin-system tool (InstallPlugin, ProposePlugin, ...); that is always rejected.\",\n\t\t],\n\t\tparameters: updateParams,\n\t\tasync execute(_id, params: Static<typeof updateParams>, _signal, _onUpdate, ctx: ExtensionContext) {\n\t\t\tconst violation = guardrailViolation(params);\n\t\t\tif (violation) return reject(params.id, violation);\n\n\t\t\tconst existing = getPlugin(ctx.cwd, params.id);\n\t\t\tif (!existing) {\n\t\t\t\treturn reject(\n\t\t\t\t\tparams.id,\n\t\t\t\t\t`No plugin named \"${params.id}\" is installed. Use ProposePlugin to create it first.`,\n\t\t\t\t);\n\t\t\t}\n\t\t\t// Authored-only: marketplace installs land in the same directory but don't\n\t\t\t// round-trip losslessly through our emitters (see mergePluginDraft).\n\t\t\tif (!isAuthoredPlugin(ctx.cwd, params.id)) {\n\t\t\t\treturn reject(\n\t\t\t\t\tparams.id,\n\t\t\t\t\t`Plugin \"${params.id}\" was not authored in this workspace (likely installed from a marketplace). ` +\n\t\t\t\t\t\t\"UpdatePlugin only modifies locally authored plugins — updating a marketplace plugin is a human \" +\n\t\t\t\t\t\t\"action (uninstall it and install a newer version instead).\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (capabilityCount(params) === 0 && !params.version && !params.description) {\n\t\t\t\treturn reject(\n\t\t\t\t\tparams.id,\n\t\t\t\t\t\"Nothing to update. Provide skills, commands, subagents, hooks, mcpServers, or metadata.\",\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// Gate on the DELTA only — existing executables aren't re-confirmed.\n\t\t\tconst gate = await passExecutableGate(params.id, params, ctx);\n\t\t\tif (!gate.ok) return gate.result;\n\n\t\t\t// No model-facing platform selection: a merge keeps the plugin's existing\n\t\t\t// layout (mergePluginDraft defaults to existing.supportPlatform).\n\t\t\tconst result = mergePluginDraft(ctx.cwd, params.id, draftFrom(params.id, params, existing.supportPlatform));\n\t\t\tconst platforms = result.plugin?.supportPlatform ?? existing.supportPlatform;\n\t\t\tconst activation = ctx.activatePlugin(result.dest);\n\t\t\tconst text = `${summarizeWrite(params.id, platforms, result.files, result.dest, \"Updated\")}\\n${activation.message}`;\n\t\t\tctx.ui.notify(`Updated plugin \"${params.id}\" (${platforms.join(\", \")}).`, \"info\");\n\t\t\treturn {\n\t\t\t\tcontent: [{ type: \"text\" as const, text }],\n\t\t\t\tdetails: { id: params.id, authored: true, confirmed: gate.gated },\n\t\t\t};\n\t\t},\n\t});\n}\n\n// ── RemovePluginCapability (subtract from an authored plugin) ─────────────────\n\nconst hookRemovalSchema = Type.Object(\n\t{\n\t\tevent: Type.String({ description: \"Event of the hook(s) to remove, e.g. PreToolUse.\" }),\n\t\tmatcher: Type.Optional(Type.String({ description: \"Narrow to hooks with exactly this matcher.\" })),\n\t\tcommand: Type.Optional(Type.String({ description: \"Narrow to hooks with exactly this command.\" })),\n\t},\n\t{ additionalProperties: false },\n);\n\nconst removeParams = Type.Object(\n\t{\n\t\tid: Type.String({ description: \"Id of the authored plugin to remove capabilities from.\" }),\n\t\tskills: Type.Optional(Type.Array(Type.String(), { description: \"Skill names to remove.\" })),\n\t\tcommands: Type.Optional(Type.Array(Type.String(), { description: \"Command names to remove.\" })),\n\t\tsubagents: Type.Optional(Type.Array(Type.String(), { description: \"Subagent names to remove.\" })),\n\t\tmcpServers: Type.Optional(Type.Array(Type.String(), { description: \"MCP server names to remove.\" })),\n\t\thooks: Type.Optional(\n\t\t\tType.Array(hookRemovalSchema, {\n\t\t\t\tdescription: \"Hooks to remove, matched by event and narrowed by matcher/command when provided.\",\n\t\t\t}),\n\t\t),\n\t},\n\t{ additionalProperties: false },\n);\n\ninterface RemovePluginCapabilityDetails {\n\tid: string;\n\tremoved: string[];\n\tmissing: string[];\n}\n\nexport function createRemovePluginCapabilityToolDefinition(): ToolDefinition {\n\treturn defineTool<typeof removeParams, RemovePluginCapabilityDetails>({\n\t\tname: REMOVE_PLUGIN_CAPABILITY_TOOL_NAME,\n\t\tlabel: REMOVE_PLUGIN_CAPABILITY_TOOL_NAME,\n\t\tdescription:\n\t\t\t\"Remove named capabilities from a locally AUTHORED plugin — skills, commands, subagents, and MCP servers by \" +\n\t\t\t\"name; hooks by event (narrowed by matcher/command). The subtractive half of UpdatePlugin. Removal is \" +\n\t\t\t\"low-risk and autonomous (deleting capabilities cannot execute code). To remove the whole plugin, use \" +\n\t\t\t\"UninstallPlugin; marketplace-installed plugins are refused here.\",\n\t\tpromptSnippet: \"Remove capabilities from a plugin you authored (low risk; autonomous).\",\n\t\tpromptGuidelines: [\n\t\t\t\"Removal runs autonomously (the low-risk direction) — announce what you removed and why.\",\n\t\t\t\"To CHANGE a hook (hooks have no name to replace by): RemovePluginCapability the old hook, then UpdatePlugin the new one (which asks for confirmation).\",\n\t\t],\n\t\tparameters: removeParams,\n\t\tasync execute(_id, params: Static<typeof removeParams>, _signal, _onUpdate, ctx: ExtensionContext) {\n\t\t\tconst noDetails = (msg: string) => ({\n\t\t\t\tcontent: [{ type: \"text\" as const, text: msg }],\n\t\t\t\tdetails: { id: params.id, removed: [], missing: [] },\n\t\t\t});\n\n\t\t\tconst existing = getPlugin(ctx.cwd, params.id);\n\t\t\tif (!existing) {\n\t\t\t\treturn noDetails(`No plugin named \"${params.id}\" is installed.`);\n\t\t\t}\n\t\t\tif (!isAuthoredPlugin(ctx.cwd, params.id)) {\n\t\t\t\treturn noDetails(\n\t\t\t\t\t`Plugin \"${params.id}\" was not authored in this workspace (likely installed from a marketplace). ` +\n\t\t\t\t\t\t\"RemovePluginCapability only edits locally authored plugins — use UninstallPlugin to remove it entirely.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst requested =\n\t\t\t\t(params.skills?.length ?? 0) +\n\t\t\t\t(params.commands?.length ?? 0) +\n\t\t\t\t(params.subagents?.length ?? 0) +\n\t\t\t\t(params.mcpServers?.length ?? 0) +\n\t\t\t\t(params.hooks?.length ?? 0);\n\t\t\tif (requested === 0) {\n\t\t\t\treturn noDetails(\"Nothing to remove. Name skills, commands, subagents, mcpServers, or hooks.\");\n\t\t\t}\n\n\t\t\tconst result = removeFromPlugin(ctx.cwd, params.id, {\n\t\t\t\tskills: params.skills,\n\t\t\t\tcommands: params.commands,\n\t\t\t\tsubagents: params.subagents,\n\t\t\t\tmcpServers: params.mcpServers,\n\t\t\t\thooks: params.hooks,\n\t\t\t});\n\t\t\tconst lines: string[] = [];\n\t\t\tif (result.removed.length > 0) {\n\t\t\t\tlines.push(`Removed from plugin \"${params.id}\":`, ...result.removed.map((r) => `  ${r}`));\n\t\t\t}\n\t\t\tif (result.missing.length > 0) {\n\t\t\t\tlines.push(`Not found (nothing removed):`, ...result.missing.map((m) => `  ${m}`));\n\t\t\t}\n\t\t\tconst text = lines.join(\"\\n\");\n\t\t\t// Removal takes effect through the reload path, same as UninstallPlugin.\n\t\t\tif (result.removed.length > 0) ctx.requestReloadWhenIdle();\n\t\t\tctx.ui.notify(text, result.removed.length > 0 ? \"info\" : \"warning\");\n\t\t\treturn {\n\t\t\t\tcontent: [{ type: \"text\" as const, text }],\n\t\t\t\tdetails: { id: params.id, removed: result.removed, missing: result.missing },\n\t\t\t};\n\t\t},\n\t});\n}\n\n/** All three authoring tool definitions, for registration on the top-level agent. */\nexport function createProposePluginToolDefinitions(): ToolDefinition[] {\n\treturn [\n\t\tcreateProposePluginToolDefinition(),\n\t\tcreateUpdatePluginToolDefinition(),\n\t\tcreateRemovePluginCapabilityToolDefinition(),\n\t];\n}\n"]}
+{"version":3,"file":"propose-plugin.d.ts","sourceRoot":"","sources":["../../../src/core/tools/propose-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAoBH,OAAO,EAAc,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAsPzE,wBAAgB,iCAAiC,IAAI,cAAc,CAkFlE;AASD,wBAAgB,gCAAgC,IAAI,cAAc,CA+DjE;AAmCD,wBAAgB,0CAA0C,IAAI,cAAc,CAiE3E;AAED,qFAAqF;AACrF,wBAAgB,kCAAkC,IAAI,cAAc,EAAE,CAMrE","sourcesContent":["/**\n * Capability authoring tools (spec §3), refactored to a single risk-gated path.\n *\n *   ProposePlugin  author a NEW plugin from any capability mix — skills,\n *                  commands, subagents, hooks, MCP servers. The risk gate is\n *                  *computed from content*, not pre-declared by tool choice:\n *                  passive content (skills, commands, read-only subagents) is\n *                  authored autonomously; executable content (hooks, MCP servers,\n *                  mutating/high-privilege subagents) auto-triggers a \"show the\n *                  code + tool grant → human confirms → activate\" gate in the\n *                  same call. A mixed plugin (skill + hook) is authored in one\n *                  call, and a hook can never be mis-routed through a \"passive\"\n *                  tool because the gate keys off what the draft contains.\n *   UpdatePlugin   merge inline-authored capabilities into an EXISTING local\n *                  plugin. Nothing is fetched from a remote, so the supply-chain\n *                  \"benign v1 → hostile v2\" risk that keeps a marketplace\n *                  UpdatePlugin out of the model's hands does not apply here;\n *                  executable additions still pass through the same confirm gate.\n *\n * Both author into `.agents/plugins/<id>/` in the requested vendor layouts\n * (Claude Code + GitHub Copilot by default) via the format registry, so results\n * are proper, publishable plugins that round-trip through parsePluginDir.\n *\n * Privilege-amplification guardrail: an authored subagent may never carry a\n * plugin-system (capability-acquisition) tool in its allowlist — enforced in\n * both tools — so a low-trust authored agent cannot bootstrap privilege.\n */\n\nimport { type Static, Type } from \"typebox\";\nimport {\n\tclassifyAllowlist,\n\tgetPlugin,\n\tisAuthoredPlugin,\n\tmergePluginDraft,\n\tpluginExists,\n\tpromoteDraft,\n\tremoveFromPlugin,\n\tresolvePluginPlatforms,\n\twritePluginDraft,\n} from \"../extensions/plugins/authoring.js\";\nimport type { PluginPlatform } from \"../extensions/plugins/formats/platform-targets.js\";\nimport type { MarketplacePlatform, PluginDraft } from \"../extensions/plugins/formats/types.js\";\nimport { formatGateFindings, runStaticGates, withFindings } from \"../extensions/plugins/gates.js\";\nimport { discardDraftDir } from \"../extensions/plugins/locations.js\";\nimport { runSmokeGate } from \"../extensions/plugins/smoke.js\";\nimport type { ExtensionContext } from \"../extensions/types.js\";\nimport { defineTool, type ToolDefinition } from \"../extensions/types.js\";\nimport {\n\tPROPOSE_PLUGIN_TOOL_NAME,\n\tREMOVE_PLUGIN_CAPABILITY_TOOL_NAME,\n\tUPDATE_PLUGIN_TOOL_NAME,\n} from \"./plugin-tool-names.js\";\n\nconst skillSchema = Type.Object(\n\t{\n\t\tname: Type.String({ description: \"Skill name.\" }),\n\t\tdescription: Type.Optional(Type.String({ description: \"One-line trigger description (kept lazy in context).\" })),\n\t\tbody: Type.String({ description: \"SKILL.md instruction body (markdown).\" }),\n\t},\n\t{ additionalProperties: false },\n);\n\nconst commandSchema = Type.Object(\n\t{\n\t\tname: Type.String({ description: \"Command name (invoked as /name).\" }),\n\t\tdescription: Type.Optional(Type.String({ description: \"One-line description.\" })),\n\t\tbody: Type.String({ description: \"Prompt template body (markdown).\" }),\n\t},\n\t{ additionalProperties: false },\n);\n\nconst subagentSchema = Type.Object(\n\t{\n\t\tname: Type.String({ description: \"Subagent name.\" }),\n\t\tdescription: Type.Optional(Type.String({ description: \"When to dispatch this subagent.\" })),\n\t\ttools: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tdescription:\n\t\t\t\t\t\"Comma-separated allowed-tools, e.g. 'read, grep, glob'. Read-only grants are autonomous; \" +\n\t\t\t\t\t\"mutating/exec/network grants (Bash, Write, Edit, MCP) or '*' require human confirmation. Omit for none.\",\n\t\t\t}),\n\t\t),\n\t\tmodel: Type.Optional(Type.String({ description: \"Model override, or 'inherit'.\" })),\n\t\tbody: Type.String({ description: \"System-prompt / instruction body (markdown).\" }),\n\t},\n\t{ additionalProperties: false },\n);\n\nconst hookSchema = Type.Object(\n\t{\n\t\tevent: Type.String({ description: \"Event: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, Stop, ...\" }),\n\t\tmatcher: Type.Optional(Type.String({ description: \"Regex matched against the tool name. Empty/'*' = all.\" })),\n\t\tcommand: Type.String({ description: \"Shell command to run on the event.\" }),\n\t\ttimeout: Type.Optional(Type.Number({ description: \"Timeout in seconds.\" })),\n\t},\n\t{ additionalProperties: false },\n);\n\nconst mcpServerSchema = Type.Object(\n\t{\n\t\tname: Type.String({ description: \"MCP server name.\" }),\n\t\tcommand: Type.String({ description: \"Executable to launch the server.\" }),\n\t\targs: Type.Optional(Type.Array(Type.String(), { description: \"Command arguments.\" })),\n\t\tenv: Type.Optional(Type.Record(Type.String(), Type.String(), { description: \"Environment variables.\" })),\n\t},\n\t{ additionalProperties: false },\n);\n\n/** The capability params shared by ProposePlugin (create) and UpdatePlugin (merge). */\nconst capabilityProps = {\n\tdescription: Type.Optional(Type.String({ description: \"Plugin description.\" })),\n\tversion: Type.Optional(Type.String({ description: \"Plugin version, e.g. '0.1.0'.\" })),\n\tskills: Type.Optional(Type.Array(skillSchema)),\n\tcommands: Type.Optional(Type.Array(commandSchema)),\n\tsubagents: Type.Optional(\n\t\tType.Array(subagentSchema, {\n\t\t\tdescription: \"Subagents. Read-only allowlists are autonomous; mutating ones trigger human confirmation.\",\n\t\t}),\n\t),\n\thooks: Type.Optional(Type.Array(hookSchema, { description: \"Shell hooks (executable — trigger confirmation).\" })),\n\tmcpServers: Type.Optional(\n\t\tType.Array(mcpServerSchema, { description: \"MCP servers (executable — trigger confirmation).\" }),\n\t),\n} as const;\n\n/** Union of every capability a draft can carry (used to build a draft and to classify risk). */\ninterface CapabilityInput {\n\tdescription?: string;\n\tversion?: string;\n\tskills?: Static<typeof skillSchema>[];\n\tcommands?: Static<typeof commandSchema>[];\n\tsubagents?: Static<typeof subagentSchema>[];\n\thooks?: Static<typeof hookSchema>[];\n\tmcpServers?: Static<typeof mcpServerSchema>[];\n}\n\nfunction resolvePlatforms(): PluginPlatform[] {\n\t// No model-facing platform selection: the human picks the target ecosystem\n\t// with --platform, defaulting to claude. A plugin is a distribution unit, so\n\t// there is no vendor-neutral option here. See resolvePluginPlatforms.\n\treturn resolvePluginPlatforms();\n}\n\nfunction draftFrom(id: string, params: CapabilityInput, platforms: MarketplacePlatform[]): PluginDraft {\n\treturn {\n\t\tid,\n\t\tversion: params.version,\n\t\tdescription: params.description,\n\t\tsupportPlatform: platforms,\n\t\tskills: params.skills,\n\t\tcommands: params.commands,\n\t\tagents: params.subagents,\n\t\thooks: params.hooks,\n\t\tmcpServers: params.mcpServers,\n\t};\n}\n\n/** Total capabilities carried by the draft (empty arrays count as nothing). */\nfunction capabilityCount(params: CapabilityInput): number {\n\treturn (\n\t\t(params.skills?.length ?? 0) +\n\t\t(params.commands?.length ?? 0) +\n\t\t(params.subagents?.length ?? 0) +\n\t\t(params.hooks?.length ?? 0) +\n\t\t(params.mcpServers?.length ?? 0)\n\t);\n}\n\n/** The subagents whose allowlist makes them mutating/high-privilege (need the confirm gate). */\nfunction mutatingSubagents(params: CapabilityInput): Static<typeof subagentSchema>[] {\n\treturn (params.subagents ?? []).filter((sa) => classifyAllowlist(sa.tools).risk === \"mutating\");\n}\n\n/** True when the draft carries anything executable — hooks, MCP servers, or a mutating subagent. */\nfunction hasExecutable(params: CapabilityInput): boolean {\n\treturn (\n\t\t(params.hooks?.length ?? 0) > 0 || (params.mcpServers?.length ?? 0) > 0 || mutatingSubagents(params).length > 0\n\t);\n}\n\n/** Reject if any subagent carries a plugin-system tool (privilege-amplification guardrail). Returns the message, or null. */\nfunction guardrailViolation(params: CapabilityInput): string | null {\n\tfor (const sa of params.subagents ?? []) {\n\t\tconst cls = classifyAllowlist(sa.tools);\n\t\tif (cls.pluginTools.length > 0) {\n\t\t\treturn (\n\t\t\t\t`Subagent \"${sa.name}\" requests plugin-system tools (${cls.pluginTools.join(\", \")}). ` +\n\t\t\t\t\"Authored subagents may never carry capability-acquisition tools.\"\n\t\t\t);\n\t\t}\n\t}\n\treturn null;\n}\n\n/** Build the human-facing review text: the executable code and every mutating tool grant. */\nfunction buildReview(id: string, params: CapabilityInput): string {\n\tconst lines: string[] = [`Plugin \"${id}\" wants to install executable capabilities:`];\n\tfor (const h of params.hooks ?? []) {\n\t\tlines.push(`  hook [${h.event}${h.matcher ? ` matcher=${h.matcher}` : \"\"}]: ${h.command}`);\n\t}\n\tfor (const s of params.mcpServers ?? []) {\n\t\tlines.push(`  mcp server \"${s.name}\": ${s.command}${s.args?.length ? ` ${s.args.join(\" \")}` : \"\"}`);\n\t}\n\tfor (const sa of mutatingSubagents(params)) {\n\t\tlines.push(`  subagent \"${sa.name}\" tools: ${sa.tools ?? \"(none)\"} (${classifyAllowlist(sa.tools).reason})`);\n\t}\n\treturn lines.join(\"\\n\");\n}\n\nfunction summarizeWrite(\n\tid: string,\n\tplatforms: MarketplacePlatform[],\n\tfiles: string[],\n\tdest: string,\n\tverb: string,\n): string {\n\treturn (\n\t\t`${verb} plugin \"${id}\" (${platforms.join(\", \")}) with ${files.length} file(s) at ${dest}:\\n` +\n\t\tfiles.map((f) => `  ${f}`).join(\"\\n\") +\n\t\t`\\nRemove it with UninstallPlugin.`\n\t);\n}\n\ninterface AuthorPluginDetails {\n\tid: string;\n\tauthored: boolean;\n\t/** Whether an executable-capability confirmation gate ran (and was accepted). */\n\tconfirmed?: boolean;\n}\n\nfunction reject(\n\tid: string,\n\tmessage: string,\n): {\n\tcontent: { type: \"text\"; text: string }[];\n\tdetails: AuthorPluginDetails;\n} {\n\treturn { content: [{ type: \"text\" as const, text: message }], details: { id, authored: false } };\n}\n\n/**\n * Run the shared \"executable capabilities → show → confirm\" gate. Returns:\n *  - `{ ok: true }` when there is nothing executable, or the human confirmed;\n *  - a tool result (authored:false) when there is no UI to confirm on, or the\n *    human declined.\n */\nasync function passExecutableGate(\n\tid: string,\n\tparams: CapabilityInput,\n\tctx: ExtensionContext,\n\tevidence?: string,\n): Promise<{ ok: true; gated: boolean } | { ok: false; result: ReturnType<typeof reject> }> {\n\tif (!hasExecutable(params)) return { ok: true, gated: false };\n\n\t// The gate results go in the prompt, not just the tool result. A human shown a\n\t// bare shell command has no basis to approve it; \"ran the checks, here is what\n\t// they found\" is what makes the confirmation a decision rather than a formality.\n\tconst review = evidence ? `${buildReview(id, params)}\\n\\n${evidence}` : buildReview(id, params);\n\tctx.ui.notify(review, \"warning\");\n\tif (!ctx.hasUI) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\tresult: reject(\n\t\t\t\tid,\n\t\t\t\t\"Authoring executable capabilities requires human confirmation, which is unavailable in this mode. \" +\n\t\t\t\t\t`Not activated.\\n${review}`,\n\t\t\t),\n\t\t};\n\t}\n\tconst confirmed = await ctx.ui.confirm(\n\t\t`Author executable plugin \"${id}\"?`,\n\t\t`${review}\\n\\nThis installs and can run the code above. Activate it?`,\n\t);\n\tif (!confirmed) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\tresult: {\n\t\t\t\tcontent: [{ type: \"text\" as const, text: `Declined — plugin \"${id}\" was not authored.` }],\n\t\t\t\tdetails: { id, authored: false, confirmed: false },\n\t\t\t},\n\t\t};\n\t}\n\treturn { ok: true, gated: true };\n}\n\n// ── ProposePlugin (create) ────────────────────────────────────────────────────\n\nconst proposeParams = Type.Object(\n\t{ id: Type.String({ description: \"Plugin id (directory + manifest name).\" }), ...capabilityProps },\n\t{ additionalProperties: false },\n);\n\nexport function createProposePluginToolDefinition(): ToolDefinition {\n\treturn defineTool<typeof proposeParams, AuthorPluginDetails>({\n\t\tname: PROPOSE_PLUGIN_TOOL_NAME,\n\t\tlabel: PROPOSE_PLUGIN_TOOL_NAME,\n\t\tdescription:\n\t\t\t\"Author a NEW portable, reusable plugin to fill a capability gap when no marketplace plugin fits. Accepts any \" +\n\t\t\t\"capability mix — skills, slash commands, subagents, hooks, MCP servers. Authored as one self-contained \" +\n\t\t\t\"artifact usable across sessions and projects. Passive content (skills, commands, read-only \" +\n\t\t\t\"subagents) is authored autonomously; executable content (hooks, MCP servers, mutating subagents) is shown \" +\n\t\t\t\"and requires human confirmation before it activates. To change an existing plugin, use UpdatePlugin.\",\n\t\tpromptSnippet:\n\t\t\t\"Author a new portable, reusable plugin to fill a capability gap (passive is autonomous; executable asks to confirm).\",\n\t\t// Trimmed to the trigger and the two hard prohibitions. The craft guidance —\n\t\t// portability rules, capability-not-task naming, the one-call shape — was\n\t\t// ~600 tok/turn of always-on prose restating a how-to. It is the\n\t\t// `plugin-authoring` skill in the bundled marketplace now, read on demand.\n\t\tpromptGuidelines: [\n\t\t\t\"Sense reusability proactively: a multi-step recipe you'd plausibly repeat (or repeated twice in one session) that SearchPlugins does not already cover is worth authoring. Read the plugin-authoring skill first if it is available; it decides naming, portability and shape.\",\n\t\t\t\"Announce what you authored and why — passive content activates without asking, so the user learns it exists only if you say so.\",\n\t\t\t\"Never grant a subagent any plugin-system tool (InstallPlugin, ProposePlugin, ...); that is always rejected.\",\n\t\t\t\"Publishing to a marketplace stays a human action — never do it autonomously.\",\n\t\t],\n\t\tparameters: proposeParams,\n\t\tasync execute(_id, params: Static<typeof proposeParams>, _signal, _onUpdate, ctx: ExtensionContext) {\n\t\t\tconst violation = guardrailViolation(params);\n\t\t\tif (violation) return reject(params.id, violation);\n\n\t\t\tif (capabilityCount(params) === 0) {\n\t\t\t\treturn reject(params.id, \"Nothing to author. Provide skills, commands, subagents, hooks, or mcpServers.\");\n\t\t\t}\n\n\t\t\tconst platforms = resolvePlatforms();\n\t\t\t// Scoped to the target platform's home: the same id on another platform is\n\t\t\t// a separate ecosystem artifact, not a duplicate.\n\t\t\tif (pluginExists(params.id, platforms)) {\n\t\t\t\treturn reject(\n\t\t\t\t\tparams.id,\n\t\t\t\t\t`A ${platforms.join(\"/\")} plugin named \"${params.id}\" already exists. ` +\n\t\t\t\t\t\t\"Use UpdatePlugin to change it, or pick another id.\",\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// Emit to an ephemeral draft first: the gates need something real to run\n\t\t\t// against, and a production home is live (Claude Code loads\n\t\t\t// ~/.claude/skills on its next session), so nothing may land there until\n\t\t\t// the checks pass and — for executable content — the human agrees.\n\t\t\tconst draft = writePluginDraft(draftFrom(params.id, params, platforms), platforms, { promote: false });\n\t\t\tlet evaluation = runStaticGates(draft.dest, { platform: platforms[0] });\n\t\t\t// G3 only for executable content, and only once the cheap gates are\n\t\t\t// happy: no point running a hook whose command G2 already rejected.\n\t\t\tif (evaluation.ok && evaluation.plugin && hasExecutable(params)) {\n\t\t\t\tevaluation = withFindings(evaluation, await runSmokeGate(evaluation.plugin));\n\t\t\t}\n\t\t\tif (!evaluation.ok) {\n\t\t\t\tdiscardDraftDir(draft.dest);\n\t\t\t\treturn reject(\n\t\t\t\t\tparams.id,\n\t\t\t\t\t`Plugin \"${params.id}\" was not authored — it failed its checks.\\n` +\n\t\t\t\t\t\t`${formatGateFindings(evaluation)}\\nFix the issues and try again.`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst gate = await passExecutableGate(params.id, params, ctx, formatGateFindings(evaluation));\n\t\t\tif (!gate.ok) {\n\t\t\t\tdiscardDraftDir(draft.dest);\n\t\t\t\treturn gate.result;\n\t\t\t}\n\n\t\t\tconst dest = promoteDraft(draft.dest, params.id, platforms);\n\t\t\t// Passive capabilities activate live — usable on the very next model request,\n\t\t\t// this same turn; hooks/MCP servers activate via the reload once the turn ends.\n\t\t\tconst activation = ctx.activatePlugin(dest);\n\t\t\tconst text =\n\t\t\t\t`${summarizeWrite(params.id, platforms, draft.files, dest, \"Authored\")}\\n` +\n\t\t\t\t`${formatGateFindings(evaluation)}\\n${activation.message}`;\n\t\t\tctx.ui.notify(`Authored plugin \"${params.id}\" (${platforms.join(\", \")}).`, \"info\");\n\t\t\treturn {\n\t\t\t\tcontent: [{ type: \"text\" as const, text }],\n\t\t\t\tdetails: { id: params.id, authored: true, confirmed: gate.gated },\n\t\t\t};\n\t\t},\n\t});\n}\n\n// ── UpdatePlugin (merge into an existing local plugin) ─────────────────────────\n\nconst updateParams = Type.Object(\n\t{ id: Type.String({ description: \"Id of the existing local plugin to update.\" }), ...capabilityProps },\n\t{ additionalProperties: false },\n);\n\nexport function createUpdatePluginToolDefinition(): ToolDefinition {\n\treturn defineTool<typeof updateParams, AuthorPluginDetails>({\n\t\tname: UPDATE_PLUGIN_TOOL_NAME,\n\t\tlabel: UPDATE_PLUGIN_TOOL_NAME,\n\t\tdescription:\n\t\t\t\"Merge inline-authored capabilities into an EXISTING locally AUTHORED plugin (marketplace-installed plugins \" +\n\t\t\t\"are refused). Skills/commands/subagents are added or replaced by name; hooks and MCP servers are unioned \" +\n\t\t\t\"with what's already there; metadata is overwritten only where you supply it. Additive only — remove a \" +\n\t\t\t\"capability with RemovePluginCapability. Nothing is fetched from a remote. Keep additions as portable as \" +\n\t\t\t\"the original, and in its existing layout. Passive additions apply autonomously; executable additions (hooks, MCP \" +\n\t\t\t\"servers, mutating subagents) require human confirmation. Use ProposePlugin to create.\",\n\t\tpromptSnippet:\n\t\t\t\"Add/replace capabilities in a portable plugin you authored (additive; executable additions ask to confirm).\",\n\t\tpromptGuidelines: [\n\t\t\t\"Hooks cannot be modified in place: they have no name, so supplying a changed command ADDS a second hook alongside the old one (both fire). To change a hook, RemovePluginCapability the old one first, then add the new one here.\",\n\t\t\t\"Never grant a subagent any plugin-system tool (InstallPlugin, ProposePlugin, ...); that is always rejected.\",\n\t\t],\n\t\tparameters: updateParams,\n\t\tasync execute(_id, params: Static<typeof updateParams>, _signal, _onUpdate, ctx: ExtensionContext) {\n\t\t\tconst violation = guardrailViolation(params);\n\t\t\tif (violation) return reject(params.id, violation);\n\n\t\t\tconst existing = getPlugin(ctx.cwd, params.id);\n\t\t\tif (!existing) {\n\t\t\t\treturn reject(\n\t\t\t\t\tparams.id,\n\t\t\t\t\t`No plugin named \"${params.id}\" is installed. Use ProposePlugin to create it first.`,\n\t\t\t\t);\n\t\t\t}\n\t\t\t// Authored-only: marketplace installs land in the same directory but don't\n\t\t\t// round-trip losslessly through our emitters (see mergePluginDraft).\n\t\t\tif (!isAuthoredPlugin(ctx.cwd, params.id)) {\n\t\t\t\treturn reject(\n\t\t\t\t\tparams.id,\n\t\t\t\t\t`Plugin \"${params.id}\" was not authored in this workspace (likely installed from a marketplace). ` +\n\t\t\t\t\t\t\"UpdatePlugin only modifies locally authored plugins — updating a marketplace plugin is a human \" +\n\t\t\t\t\t\t\"action (uninstall it and install a newer version instead).\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (capabilityCount(params) === 0 && !params.version && !params.description) {\n\t\t\t\treturn reject(\n\t\t\t\t\tparams.id,\n\t\t\t\t\t\"Nothing to update. Provide skills, commands, subagents, hooks, mcpServers, or metadata.\",\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// Gate on the DELTA only — existing executables aren't re-confirmed.\n\t\t\tconst gate = await passExecutableGate(params.id, params, ctx);\n\t\t\tif (!gate.ok) return gate.result;\n\n\t\t\t// No model-facing platform selection: a merge keeps the plugin's existing\n\t\t\t// layout (mergePluginDraft defaults to existing.supportPlatform).\n\t\t\tconst result = mergePluginDraft(ctx.cwd, params.id, draftFrom(params.id, params, existing.supportPlatform));\n\t\t\tconst platforms = result.plugin?.supportPlatform ?? existing.supportPlatform;\n\t\t\tconst activation = ctx.activatePlugin(result.dest);\n\t\t\tconst text = `${summarizeWrite(params.id, platforms, result.files, result.dest, \"Updated\")}\\n${activation.message}`;\n\t\t\tctx.ui.notify(`Updated plugin \"${params.id}\" (${platforms.join(\", \")}).`, \"info\");\n\t\t\treturn {\n\t\t\t\tcontent: [{ type: \"text\" as const, text }],\n\t\t\t\tdetails: { id: params.id, authored: true, confirmed: gate.gated },\n\t\t\t};\n\t\t},\n\t});\n}\n\n// ── RemovePluginCapability (subtract from an authored plugin) ─────────────────\n\nconst hookRemovalSchema = Type.Object(\n\t{\n\t\tevent: Type.String({ description: \"Event of the hook(s) to remove, e.g. PreToolUse.\" }),\n\t\tmatcher: Type.Optional(Type.String({ description: \"Narrow to hooks with exactly this matcher.\" })),\n\t\tcommand: Type.Optional(Type.String({ description: \"Narrow to hooks with exactly this command.\" })),\n\t},\n\t{ additionalProperties: false },\n);\n\nconst removeParams = Type.Object(\n\t{\n\t\tid: Type.String({ description: \"Id of the authored plugin to remove capabilities from.\" }),\n\t\tskills: Type.Optional(Type.Array(Type.String(), { description: \"Skill names to remove.\" })),\n\t\tcommands: Type.Optional(Type.Array(Type.String(), { description: \"Command names to remove.\" })),\n\t\tsubagents: Type.Optional(Type.Array(Type.String(), { description: \"Subagent names to remove.\" })),\n\t\tmcpServers: Type.Optional(Type.Array(Type.String(), { description: \"MCP server names to remove.\" })),\n\t\thooks: Type.Optional(\n\t\t\tType.Array(hookRemovalSchema, {\n\t\t\t\tdescription: \"Hooks to remove, matched by event and narrowed by matcher/command when provided.\",\n\t\t\t}),\n\t\t),\n\t},\n\t{ additionalProperties: false },\n);\n\ninterface RemovePluginCapabilityDetails {\n\tid: string;\n\tremoved: string[];\n\tmissing: string[];\n}\n\nexport function createRemovePluginCapabilityToolDefinition(): ToolDefinition {\n\treturn defineTool<typeof removeParams, RemovePluginCapabilityDetails>({\n\t\tname: REMOVE_PLUGIN_CAPABILITY_TOOL_NAME,\n\t\tlabel: REMOVE_PLUGIN_CAPABILITY_TOOL_NAME,\n\t\tdescription:\n\t\t\t\"Remove named capabilities from a locally AUTHORED plugin — skills, commands, subagents, and MCP servers by \" +\n\t\t\t\"name; hooks by event (narrowed by matcher/command). The subtractive half of UpdatePlugin. Removal is \" +\n\t\t\t\"low-risk and autonomous (deleting capabilities cannot execute code). To remove the whole plugin, use \" +\n\t\t\t\"UninstallPlugin; marketplace-installed plugins are refused here.\",\n\t\tpromptSnippet: \"Remove capabilities from a plugin you authored (low risk; autonomous).\",\n\t\tpromptGuidelines: [\n\t\t\t\"Removal runs autonomously (the low-risk direction) — announce what you removed and why.\",\n\t\t\t\"To CHANGE a hook (hooks have no name to replace by): RemovePluginCapability the old hook, then UpdatePlugin the new one (which asks for confirmation).\",\n\t\t],\n\t\tparameters: removeParams,\n\t\tasync execute(_id, params: Static<typeof removeParams>, _signal, _onUpdate, ctx: ExtensionContext) {\n\t\t\tconst noDetails = (msg: string) => ({\n\t\t\t\tcontent: [{ type: \"text\" as const, text: msg }],\n\t\t\t\tdetails: { id: params.id, removed: [], missing: [] },\n\t\t\t});\n\n\t\t\tconst existing = getPlugin(ctx.cwd, params.id);\n\t\t\tif (!existing) {\n\t\t\t\treturn noDetails(`No plugin named \"${params.id}\" is installed.`);\n\t\t\t}\n\t\t\tif (!isAuthoredPlugin(ctx.cwd, params.id)) {\n\t\t\t\treturn noDetails(\n\t\t\t\t\t`Plugin \"${params.id}\" was not authored in this workspace (likely installed from a marketplace). ` +\n\t\t\t\t\t\t\"RemovePluginCapability only edits locally authored plugins — use UninstallPlugin to remove it entirely.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst requested =\n\t\t\t\t(params.skills?.length ?? 0) +\n\t\t\t\t(params.commands?.length ?? 0) +\n\t\t\t\t(params.subagents?.length ?? 0) +\n\t\t\t\t(params.mcpServers?.length ?? 0) +\n\t\t\t\t(params.hooks?.length ?? 0);\n\t\t\tif (requested === 0) {\n\t\t\t\treturn noDetails(\"Nothing to remove. Name skills, commands, subagents, mcpServers, or hooks.\");\n\t\t\t}\n\n\t\t\tconst result = removeFromPlugin(ctx.cwd, params.id, {\n\t\t\t\tskills: params.skills,\n\t\t\t\tcommands: params.commands,\n\t\t\t\tsubagents: params.subagents,\n\t\t\t\tmcpServers: params.mcpServers,\n\t\t\t\thooks: params.hooks,\n\t\t\t});\n\t\t\tconst lines: string[] = [];\n\t\t\tif (result.removed.length > 0) {\n\t\t\t\tlines.push(`Removed from plugin \"${params.id}\":`, ...result.removed.map((r) => `  ${r}`));\n\t\t\t}\n\t\t\tif (result.missing.length > 0) {\n\t\t\t\tlines.push(`Not found (nothing removed):`, ...result.missing.map((m) => `  ${m}`));\n\t\t\t}\n\t\t\tconst text = lines.join(\"\\n\");\n\t\t\t// Removal takes effect through the reload path, same as UninstallPlugin.\n\t\t\tif (result.removed.length > 0) ctx.requestReloadWhenIdle();\n\t\t\tctx.ui.notify(text, result.removed.length > 0 ? \"info\" : \"warning\");\n\t\t\treturn {\n\t\t\t\tcontent: [{ type: \"text\" as const, text }],\n\t\t\t\tdetails: { id: params.id, removed: result.removed, missing: result.missing },\n\t\t\t};\n\t\t},\n\t});\n}\n\n/** All three authoring tool definitions, for registration on the top-level agent. */\nexport function createProposePluginToolDefinitions(): ToolDefinition[] {\n\treturn [\n\t\tcreateProposePluginToolDefinition(),\n\t\tcreateUpdatePluginToolDefinition(),\n\t\tcreateRemovePluginCapabilityToolDefinition(),\n\t];\n}\n"]}

package/dist/core/tools/propose-plugin.js

@@ -189,12 +189,15 @@ export function createProposePluginToolDefinition() {
             "subagents) is authored autonomously; executable content (hooks, MCP servers, mutating subagents) is shown " +
             "and requires human confirmation before it activates. To change an existing plugin, use UpdatePlugin.",
         promptSnippet: "Author a new portable, reusable plugin to fill a capability gap (passive is autonomous; executable asks to confirm).",
+        // Trimmed to the trigger and the two hard prohibitions. The craft guidance —
+        // portability rules, capability-not-task naming, the one-call shape — was
+        // ~600 tok/turn of always-on prose restating a how-to. It is the
+        // `plugin-authoring` skill in the bundled marketplace now, read on demand.
         promptGuidelines: [
-            "Sense reusability proactively: when you complete a multi-step recipe you'd plausibly repeat (or repeat the same pattern twice in one session) and SearchPlugins finds nothing that covers it, author it with ProposePlugin. Name and describe it by the capability, not the one-off task that prompted it, so it triggers again in other contexts. Passive skills/commands activate immediately and are reversible with UninstallPlugin — announce what you created and why.",
-            "Author for portability: write self-contained content — no absolute or machine-specific paths, no embedded secrets or environment-specific values, no assumptions about the current repo unless that is the capability's point. Prefer relative paths and runtime discovery, and state any prerequisites in the body. The layout is the session's target platform; you never choose it.",
-            "One tool for the whole plugin: put skills + a hook in a single call. The risk gate is computed from content — you don't pre-classify. Read-only subagents and skills/commands go straight through; hooks, MCP servers, or a subagent needing Bash/Write/Edit/MCP or tools:* pause for human confirmation.",
+            "Sense reusability proactively: a multi-step recipe you'd plausibly repeat (or repeated twice in one session) that SearchPlugins does not already cover is worth authoring. Read the plugin-authoring skill first if it is available; it decides naming, portability and shape.",
+            "Announce what you authored and why — passive content activates without asking, so the user learns it exists only if you say so.",
             "Never grant a subagent any plugin-system tool (InstallPlugin, ProposePlugin, ...); that is always rejected.",
-            "Publishing a proven-useful plugin to a marketplace stays a human action — do not do it autonomously.",
+            "Publishing to a marketplace stays a human action — never do it autonomously.",
         ],
         parameters: proposeParams,
         async execute(_id, params, _signal, _onUpdate, ctx) {
@@ -260,10 +263,7 @@ export function createUpdatePluginToolDefinition() {
             "servers, mutating subagents) require human confirmation. Use ProposePlugin to create.",
         promptSnippet: "Add/replace capabilities in a portable plugin you authored (additive; executable additions ask to confirm).",
         promptGuidelines: [
-            "Use UpdatePlugin to grow a plugin you already authored — e.g. add a skill to it, or attach a hook. Supply only the delta; existing capabilities are preserved (a matching name replaces just that one). It cannot remove a capability — use RemovePluginCapability for that.",
-            "Keep additions portable: same content rules as ProposePlugin — no absolute paths, no secrets, capability-not-task naming.",
             "Hooks cannot be modified in place: they have no name, so supplying a changed command ADDS a second hook alongside the old one (both fire). To change a hook, RemovePluginCapability the old one first, then add the new one here.",
-            "Only executable *additions* trigger confirmation — adding a passive skill to an already-executable plugin does not re-prompt.",
             "Never grant a subagent any plugin-system tool (InstallPlugin, ProposePlugin, ...); that is always rejected.",
         ],
         parameters: updateParams,